Commit 17223f13 authored by Mariusz Skamra's avatar Mariusz Skamra Committed by Carles Cufi
Browse files

Bluetooth: audio: Fix metadata length checks 

This fixes metadata length checks for BT_AUDIO_METADATA_TYPE_EXTENDED
and BT_AUDIO_METADATA_TYPE_VENDOR that should be at least 2 bytes long.

Signed-off-by: default avatarMariusz Skamra <mariusz.skamra@codecoup.pl>
parent db5767e5

samples/bluetooth/hap_ha/src/bap_unicast_sr.c

+4 −3
Changes for samples/bluetooth/hap_ha/src/bap_unicast_sr.c: 4 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -290,9 +290,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len) 
		}



		return true;

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */

		if (len < 1) {

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */

		/* At least Extended Metadata Type / Company_ID should be there */

		if (len < 2) {

			return false;

		}

samples/bluetooth/tmap_peripheral/src/bap_unicast_sr.c

+4 −3
Changes for samples/bluetooth/tmap_peripheral/src/bap_unicast_sr.c: 4 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -239,9 +239,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len) 
		}



		return true;

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */

		if (len < 1) {

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */

		/* At least Extended Metadata Type / Company_ID should be there */

		if (len < 2) {

			return false;

		}

samples/bluetooth/unicast_audio_server/src/main.c

+4 −3
Changes for samples/bluetooth/unicast_audio_server/src/main.c: 4 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -431,9 +431,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len) 
		}



		return true;

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */

		if (len < 1) {

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */

		/* At least Extended Metadata Type / Company_ID should be there */

		if (len < 2) {

			return false;

		}

subsys/bluetooth/audio/shell/bap.c

+4 −3
Changes for subsys/bluetooth/audio/shell/bap.c: 4 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -511,9 +511,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len) 
		}



		return true;

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */

		if (len < 1) {

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */

		/* At least Extended Metadata Type / Company_ID should be there */

		if (len < 2) {

			return false;

		}

tests/bluetooth/tester/src/btp_bap.c

+4 −3
Changes for tests/bluetooth/tester/src/btp_bap.c: 4 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -353,9 +353,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len, const uint8_t *data) 
		}



		return true;

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */

		if (len < 1) {

	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */

	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */

		/* At least Extended Metadata Type / Company_ID should be there */

		if (len < 2) {

			return false;

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE