michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: Audio: Add input validation for bt_mcc_send_search

Browse source 
Add validation of the search pointer and len value.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit is contained in:
Emil Gydesen 2023-02-10 14:58:38 +01:00 • committed by Carles Cufí
commit 9ebad924ac
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
subsys/bluetooth/audio/mcc.c
View file

@ -2835,6 +2835,18 @@ int bt_mcc_send_search(struct bt_conn *conn, const struct mpl_search *search)
return -EINVAL;
}
CHECKIF(search == NULL) {
LOG_DBG("search is NULL");
return -EINVAL;
}
CHECKIF(!IN_RANGE(search->len, SEARCH_LEN_MIN, SEARCH_LEN_MAX)) {
LOG_DBG("Invalid search->len: %u", search->len);
return -EINVAL;
}
(void)memcpy(mcs_inst->write_buf, &search->search, search->len);
mcs_inst->write_params.offset = 0;