diff --git a/subsys/bluetooth/audio/mpl.c b/subsys/bluetooth/audio/mpl.c index a1c9a321da0..0863db31e2f 100644 --- a/subsys/bluetooth/audio/mpl.c +++ b/subsys/bluetooth/audio/mpl.c @@ -2622,43 +2622,41 @@ uint32_t get_commands_supported(void) } #ifdef CONFIG_BT_MPL_OBJECTS + +static bool parse_sci(struct bt_data *data, void *user_data) +{ + LOG_DBG("type: %u len %u", data->type, data->data_len); + LOG_HEXDUMP_DBG(data->data, data->data_len, "param:"); + + if (data->type < MEDIA_PROXY_SEARCH_TYPE_TRACK_NAME || + data->type > MEDIA_PROXY_SEARCH_TYPE_ONLY_GROUPS) { + LOG_DBG("Invalid search type: %u", data->type); + return false; + } + + return true; +} + static void parse_search(const struct mpl_search *search) { - uint8_t index = 0; - struct mpl_sci sci; - uint8_t sci_num = 0; bool search_failed = false; if (search->len > SEARCH_LEN_MAX) { LOG_WRN("Search too long (%d) - aborting", search->len); search_failed = true; } else { - LOG_DBG("Parsing %d octets search", search->len); + uint8_t search_ltv[SEARCH_LEN_MAX]; + struct net_buf_simple buf; - while (search->len - index > 0) { - sci.len = (uint8_t)search->search[index++]; - if (sci.len < SEARCH_SCI_LEN_MIN) { - LOG_WRN("Invalid length field - too small"); - search_failed = true; - break; - } - if (sci.len > (search->len - index)) { - LOG_WRN("Incomplete search control item"); - search_failed = true; - break; - } - sci.type = (uint8_t)search->search[index++]; - if (sci.type < MEDIA_PROXY_SEARCH_TYPE_TRACK_NAME || - sci.type > MEDIA_PROXY_SEARCH_TYPE_ONLY_GROUPS) { - search_failed = true; - break; - } - (void)memcpy(&sci.param, &search->search[index], sci.len - 1); - index += sci.len - 1; + /* Copy so that we can parse it using the net_buf_simple when search is const */ + memcpy(search_ltv, search->search, search->len); - LOG_DBG("SCI # %d: type: %d", sci_num, sci.type); - LOG_HEXDUMP_DBG(sci.param, sci.len - 1, "param:"); - sci_num++; + net_buf_simple_init_with_data(&buf, search_ltv, search->len); + + bt_data_parse(&buf, parse_sci, NULL); + + if (buf.len != 0U) { + search_failed = true; } }