Bluetooth: Audio: Add input validation for bt_mcc_send_search
Add validation of the search pointer and len value. Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit is contained in:
parent
dfe324be9c
commit
9ebad924ac
1 changed files with 12 additions and 0 deletions
|
@ -2835,6 +2835,18 @@ int bt_mcc_send_search(struct bt_conn *conn, const struct mpl_search *search)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
CHECKIF(search == NULL) {
|
||||||
|
LOG_DBG("search is NULL");
|
||||||
|
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
CHECKIF(!IN_RANGE(search->len, SEARCH_LEN_MIN, SEARCH_LEN_MAX)) {
|
||||||
|
LOG_DBG("Invalid search->len: %u", search->len);
|
||||||
|
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
(void)memcpy(mcs_inst->write_buf, &search->search, search->len);
|
(void)memcpy(mcs_inst->write_buf, &search->search, search->len);
|
||||||
|
|
||||||
mcs_inst->write_params.offset = 0;
|
mcs_inst->write_params.offset = 0;
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue