michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: audio: pacs: Hotfix invalid PACS length

Browse source 
This fixes adding 2 redundant bytes... to the PAC records.
As a result we end up with broken PAC record.

Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This commit is contained in:
Mariusz Skamra 2022-10-28 15:56:32 +02:00 • committed by Carles Cufí
commit fbeee206f2
3 changed files with 15 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

12
subsys/bluetooth/audio/pacs.c
View file

@ -109,19 +109,19 @@ static bool build_pac_records(const struct bt_pacs_cap *cap, void *user_data)
struct net_buf_simple *buf = data->buf;
struct net_buf_simple_state state;
struct bt_pac_ltv_data *cc, *meta;
struct bt_pac *pac;
struct bt_pac_codec *pac_codec;
ssize_t len;
net_buf_simple_save(buf, &state);
if (net_buf_simple_tailroom(buf) < sizeof(*pac)) {
if (net_buf_simple_tailroom(buf) < sizeof(*pac_codec)) {
goto fail;
}
pac = net_buf_simple_add(buf, sizeof(*pac));
pac->codec.id = codec->id;
pac->codec.cid = sys_cpu_to_le16(codec->cid);
pac->codec.vid = sys_cpu_to_le16(codec->vid);
pac_codec = net_buf_simple_add(buf, sizeof(*pac_codec));
pac_codec->id = codec->id;
pac_codec->cid = sys_cpu_to_le16(codec->cid);
pac_codec->vid = sys_cpu_to_le16(codec->vid);
if (net_buf_simple_tailroom(buf) < sizeof(*cc)) {
goto fail;