michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: BAP: Add missing Broadcast source param checks

Browse source 
Several input parameter checks were missing in the BAP broadcast
source API.

Signed-off-by: Emil Gydesen <emil.gydesen@nordicsemi.no>
This commit is contained in:
Emil Gydesen 2023-04-12 16:29:29 +02:00 • committed by Carles Cufí
commit fa95a7add2
3 changed files with 142 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

88
subsys/bluetooth/audio/bap_broadcast_source.c
View file

@ -545,18 +545,40 @@ static bool valid_create_param(const struct bt_bap_broadcast_source_create_param
return false;
}
CHECKIF(param->qos->rtn > BT_ISO_BROADCAST_RTN_MAX) {
LOG_DBG("param->qos->rtn %u invalid", param->qos->rtn);
return false;
}
CHECKIF(param->params == NULL) {
LOG_DBG("param->params is NULL");
return false;
}
CHECKIF(param->params_count == 0) {
LOG_DBG("param->params_count is 0");
return false;
}
for (size_t i = 0U; i < param->params_count; i++) {
const struct bt_bap_broadcast_source_subgroup_param *subgroup_param;
subgroup_param = &param->params[i];
CHECKIF(subgroup_param->params_count == 0U) {
LOG_DBG("subgroup_params[%zu].count is 0", i);
CHECKIF(subgroup_param->params == NULL) {
LOG_DBG("subgroup_params[%zu].params is NULL", i);
return false;
}
CHECKIF(subgroup_param->codec == NULL) {
LOG_DBG("subgroup_params[%zu].codec is NULL", i);
CHECKIF(!IN_RANGE(subgroup_param->params_count, 1U,
CONFIG_BT_BAP_BROADCAST_SRC_STREAM_COUNT)) {
LOG_DBG("subgroup_params[%zu].count (%zu) is invalid", i,
subgroup_param->params_count);
return false;
}
CHECKIF(!bt_audio_valid_codec(subgroup_param->codec)) {
LOG_DBG("subgroup_params[%zu].codec is invalid", i);
return false;
}
@ -577,7 +599,34 @@ static bool valid_create_param(const struct bt_bap_broadcast_source_create_param
i, j, stream_param->stream->group);
return false;
}
CHECKIF(stream_param->data == NULL && stream_param->data_count != 0) {
LOG_DBG("subgroup_params[%zu].stream_params[%zu]->data is "
"NULL with count %zu",
i, j, stream_param->data_count);
return false;
}
#if CONFIG_BT_CODEC_MAX_DATA_COUNT > 0
CHECKIF(stream_param->data_count > CONFIG_BT_CODEC_MAX_DATA_COUNT) {
LOG_DBG("subgroup_params[%zu].stream_params[%zu]->data_count too "
"large: %zu/%d",
i, j, stream_param->data_count,
CONFIG_BT_CODEC_MAX_DATA_COUNT);
return false;
}
for (size_t k = 0U; k < stream_param->data_count; k++) {
CHECKIF(!(bt_audio_valid_codec_data(&stream_param->data[k]))) {
LOG_DBG("subgroup_params[%zu].stream_params[%zu]->data[%zu]"
" invalid",
i, j, k);
return false;
}
}
}
#endif /* CONFIG_BT_CODEC_MAX_DATA_COUNT > 0 */
}
return true;
@ -631,6 +680,7 @@ int bt_bap_broadcast_source_create(struct bt_bap_broadcast_source_create_param *
LOG_DBG("out_source is NULL");
return -EINVAL;
}
/* Set out_source to NULL until the source has actually been created */
*out_source = NULL;
@ -759,6 +809,26 @@ int bt_bap_broadcast_source_reconfig(struct bt_bap_broadcast_source *source, str
return -EINVAL;
}
CHECKIF(!bt_audio_valid_codec(codec)) {
LOG_DBG("codec is invalid");
return -EINVAL;
}
CHECKIF(qos == NULL) {
LOG_DBG("qos is NULL");
return -EINVAL;
}
CHECKIF(bt_audio_verify_qos(qos) != BT_BAP_ASCS_REASON_NONE) {
LOG_DBG("qos is invalid");
return -EINVAL;
}
CHECKIF(qos->rtn > BT_ISO_BROADCAST_RTN_MAX) {
LOG_DBG("qos->rtn %u invalid", qos->rtn);
return -EINVAL;
}
broadcast_state = broadcast_source_get_state(source);
if (broadcast_source_get_state(source) != BT_BAP_EP_STATE_QOS_CONFIGURED) {
LOG_DBG("Broadcast source invalid state: %u", broadcast_state);
@ -991,6 +1061,16 @@ int bt_bap_broadcast_source_get_id(const struct bt_bap_broadcast_source *source,
int bt_bap_broadcast_source_get_base(struct bt_bap_broadcast_source *source,
struct net_buf_simple *base_buf)
{
CHECKIF(source == NULL) {
LOG_DBG("source is NULL");
return -EINVAL;
}
CHECKIF(base_buf == NULL) {
LOG_DBG("base_buf is NULL");
return -EINVAL;
}
if (!encode_base(source, base_buf)) {
LOG_DBG("base_buf %p with size %u not large enough", base_buf, base_buf->size);