michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: Audio: VOCS add missing check for offset in writes

Browse source 
VOCS does not support the write long procedure, and thus
should not accept any offset in write requests.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit is contained in:
Emil Gydesen 2021-03-23 15:03:10 +01:00 • committed by Anas Nashif
commit 30edb5e52e
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
subsys/bluetooth/audio/vocs.c
View file

@ -53,6 +53,10 @@ static ssize_t write_location(struct bt_conn *conn, const struct bt_gatt_attr *a
struct bt_vocs_server *inst = attr->user_data; struct bt_vocs_server *inst = attr->user_data;
uint32_t old_location = inst->location; uint32_t old_location = inst->location;
if (offset) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
}
if (len != sizeof(inst->location)) { if (len != sizeof(inst->location)) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN); return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
} }
@ -91,6 +95,10 @@ static ssize_t write_vocs_control(struct bt_conn *conn, const struct bt_gatt_att
const struct bt_vocs_control *cp = buf; const struct bt_vocs_control *cp = buf;
bool notify = false; bool notify = false;
if (offset) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
}
if (!len || !buf) { if (!len || !buf) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN); return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
} }
@ -101,10 +109,6 @@ static ssize_t write_vocs_control(struct bt_conn *conn, const struct bt_gatt_att
return BT_GATT_ERR(BT_VOCS_ERR_OP_NOT_SUPPORTED); return BT_GATT_ERR(BT_VOCS_ERR_OP_NOT_SUPPORTED);
} }
if (offset) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
}
if (len != sizeof(struct bt_vocs_control)) { if (len != sizeof(struct bt_vocs_control)) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN); return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
} }
@ -160,6 +164,10 @@ static ssize_t write_output_desc(struct bt_conn *conn, const struct bt_gatt_attr
{ {
struct bt_vocs_server *inst = attr->user_data; struct bt_vocs_server *inst = attr->user_data;
if (offset) {
return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
}
if (len >= sizeof(inst->output_desc)) { if (len >= sizeof(inst->output_desc)) {
BT_DBG("Output desc was clipped from length %u to %zu", BT_DBG("Output desc was clipped from length %u to %zu",
len, sizeof(inst->output_desc) - 1); len, sizeof(inst->output_desc) - 1);