diff --git a/subsys/bluetooth/audio/mcc.c b/subsys/bluetooth/audio/mcc.c index 4e3c2f02784..93b9dc9ebd0 100644 --- a/subsys/bluetooth/audio/mcc.c +++ b/subsys/bluetooth/audio/mcc.c @@ -2735,6 +2735,18 @@ int bt_mcc_send_cmd(struct bt_conn *conn, const struct mpl_cmd *cmd) return -EINVAL; } + CHECKIF(cmd == NULL) { + LOG_DBG("cmd is NULL"); + + return -EINVAL; + } + + CHECKIF(!BT_MCS_VALID_OP(cmd->opcode)) { + LOG_DBG("Opcode 0x%02X is invalid", cmd->opcode); + + return -EINVAL; + } + length = sizeof(cmd->opcode); (void)memcpy(mcs_inst->write_buf, &cmd->opcode, length); if (cmd->use_param) { diff --git a/subsys/bluetooth/audio/mcs.c b/subsys/bluetooth/audio/mcs.c index 0ef0e5bd2a1..b9c83585bdb 100644 --- a/subsys/bluetooth/audio/mcs.c +++ b/subsys/bluetooth/audio/mcs.c @@ -25,6 +25,7 @@ #include "audio_internal.h" #include "media_proxy_internal.h" +#include "mcs_internal.h" #include @@ -39,6 +40,8 @@ LOG_MODULE_REGISTER(bt_mcs, CONFIG_BT_MCS_LOG_LEVEL); */ BUILD_ASSERT(CONFIG_BT_L2CAP_TX_BUF_COUNT >= 10, "Too few L2CAP buffers"); +static void notify(const struct bt_uuid *uuid, const void *data, uint16_t len); + static struct media_proxy_sctrl_cbs cbs; static struct client_state { @@ -537,6 +540,21 @@ static ssize_t write_control_point(struct bt_conn *conn, LOG_DBG("Opcode: %d", command.opcode); command.use_param = false; + if (!BT_MCS_VALID_OP(command.opcode)) { + /* MCS does not specify what to return in case of an error - Only what to notify*/ + + const struct mpl_cmd_ntf cmd_ntf = { + .requested_opcode = command.opcode, + .result_code = BT_MCS_OPC_NTF_NOT_SUPPORTED, + }; + + LOG_DBG("Opcode 0x%02X is invalid", command.opcode); + + notify(BT_UUID_MCS_MEDIA_CONTROL_POINT, &cmd_ntf, sizeof(cmd_ntf)); + + return BT_GATT_ERR(BT_ATT_ERR_VALUE_NOT_ALLOWED); + } + if (len == sizeof(command.opcode) + sizeof(command.param)) { memcpy(&command.param, (char *)buf + sizeof(command.opcode), diff --git a/subsys/bluetooth/audio/mcs_internal.h b/subsys/bluetooth/audio/mcs_internal.h index 3178402777d..3bbce49fa14 100644 --- a/subsys/bluetooth/audio/mcs_internal.h +++ b/subsys/bluetooth/audio/mcs_internal.h @@ -19,6 +19,13 @@ extern "C" { /* This differs from BT_OTS_VALID_OBJ_ID as MCS does not use the directory list object */ #define BT_MCS_VALID_OBJ_ID(id) (IN_RANGE((id), BT_OTS_OBJ_ID_MIN, BT_OTS_OBJ_ID_MAX)) +#define BT_MCS_VALID_OP(opcode) \ + (IN_RANGE((opcode), BT_MCS_OPC_PLAY, BT_MCS_OPC_STOP) || \ + (opcode == BT_MCS_OPC_MOVE_RELATIVE) || \ + IN_RANGE((opcode), BT_MCS_OPC_PREV_SEGMENT, BT_MCS_OPC_GOTO_SEGMENT) || \ + IN_RANGE((opcode), BT_MCS_OPC_PREV_TRACK, BT_MCS_OPC_GOTO_TRACK) || \ + IN_RANGE((opcode), BT_MCS_OPC_PREV_GROUP, BT_MCS_OPC_GOTO_GROUP)) + int bt_mcs_init(struct bt_ots_cb *ots_cbs); #ifdef __cplusplus