michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: audio: pacs: Hotfix invalid PACS length

Browse source 
This fixes adding 2 redundant bytes... to the PAC records.
As a result we end up with broken PAC record.

Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This commit is contained in:
Mariusz Skamra 2022-10-28 15:56:32 +02:00 • committed by Carles Cufí
commit fbeee206f2
3 changed files with 15 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

12
subsys/bluetooth/audio/pacs.c
View file

@ -109,19 +109,19 @@ static bool build_pac_records(const struct bt_pacs_cap *cap, void *user_data)
struct net_buf_simple *buf = data->buf; struct net_buf_simple *buf = data->buf;
struct net_buf_simple_state state; struct net_buf_simple_state state;
struct bt_pac_ltv_data *cc, *meta; struct bt_pac_ltv_data *cc, *meta;
struct bt_pac *pac; struct bt_pac_codec *pac_codec;
ssize_t len; ssize_t len;
net_buf_simple_save(buf, &state); net_buf_simple_save(buf, &state);
if (net_buf_simple_tailroom(buf) < sizeof(*pac)) { if (net_buf_simple_tailroom(buf) < sizeof(*pac_codec)) {
goto fail; goto fail;
} }
pac = net_buf_simple_add(buf, sizeof(*pac)); pac_codec = net_buf_simple_add(buf, sizeof(*pac_codec));
pac->codec.id = codec->id; pac_codec->id = codec->id;
pac->codec.cid = sys_cpu_to_le16(codec->cid); pac_codec->cid = sys_cpu_to_le16(codec->cid);
pac->codec.vid = sys_cpu_to_le16(codec->vid); pac_codec->vid = sys_cpu_to_le16(codec->vid);
if (net_buf_simple_tailroom(buf) < sizeof(*cc)) { if (net_buf_simple_tailroom(buf) < sizeof(*cc)) {
goto fail; goto fail;

6
subsys/bluetooth/audio/pacs_internal.h
View file

@ -33,12 +33,6 @@ struct bt_pac_ltv_data {
struct bt_pac_ltv data[0]; struct bt_pac_ltv data[0];
} __packed; } __packed;
struct bt_pac {
struct bt_pac_codec codec; /* Codec ID */
struct bt_pac_ltv_data cc; /* Codec Specific Capabilities */
struct bt_pac_ltv_data meta; /* Metadata */
} __packed;
struct bt_pacs_read_rsp { struct bt_pacs_read_rsp {
uint8_t num_pac; /* Number of PAC Records*/ uint8_t num_pac; /* Number of PAC Records*/
} __packed; } __packed;

18
subsys/bluetooth/audio/unicast_client.c
View file

@ -2334,19 +2334,19 @@ static uint8_t unicast_client_read_func(struct bt_conn *conn, uint8_t err,
while (rsp->num_pac) { while (rsp->num_pac) {
struct unicast_client_pac *bpac; struct unicast_client_pac *bpac;
struct bt_pac *pac; struct bt_pac_codec *pac_codec;
struct bt_pac_ltv_data *meta, *cc; struct bt_pac_ltv_data *meta, *cc;
void *cc_ltv, *meta_ltv; void *cc_ltv, *meta_ltv;
BT_DBG("pac #%u", params->num_caps); BT_DBG("pac #%u", params->num_caps);
if (buf.len < sizeof(*pac)) { if (buf.len < sizeof(*pac_codec)) {
BT_ERR("Malformed PAC: remaining len %u expected %zu", BT_ERR("Malformed PAC: remaining len %u expected %zu",
buf.len, sizeof(*pac)); buf.len, sizeof(*pac_codec));
break; break;
} }
pac = net_buf_simple_pull_mem(&buf, sizeof(*pac)); pac_codec = net_buf_simple_pull_mem(&buf, sizeof(*pac_codec));
if (buf.len < sizeof(*cc)) { if (buf.len < sizeof(*cc)) {
BT_ERR("Malformed PAC: remaining len %u expected %zu", BT_ERR("Malformed PAC: remaining len %u expected %zu",
@ -2384,9 +2384,9 @@ static uint8_t unicast_client_read_func(struct bt_conn *conn, uint8_t err,
break; break;
} }
if (unicast_client_ep_set_codec(NULL, pac->codec.id, if (unicast_client_ep_set_codec(NULL, pac_codec->id,
sys_le16_to_cpu(pac->codec.cid), sys_le16_to_cpu(pac_codec->cid),
sys_le16_to_cpu(pac->codec.vid), sys_le16_to_cpu(pac_codec->vid),
cc_ltv, cc->len, cc_ltv, cc->len,
&bpac->codec)) { &bpac->codec)) {
BT_ERR("Unable to parse Codec"); BT_ERR("Unable to parse Codec");
@ -2398,8 +2398,8 @@ static uint8_t unicast_client_read_func(struct bt_conn *conn, uint8_t err,
break; break;
} }
BT_DBG("pac %p codec 0x%02x config count %u meta count %u ", BT_DBG("codec 0x%02x config count %u meta count %u ",
pac, bpac->codec.id, bpac->codec.data_count, bpac->codec.id, bpac->codec.data_count,
bpac->codec.meta_count); bpac->codec.meta_count);
params->func(conn, &bpac->codec, NULL, params); params->func(conn, &bpac->codec, NULL, params);