Bluetooth: Audio: VOCS add missing check for offset in writes (30edb5e5) · Commits · Wenxi XU / zephyr

subsys/bluetooth/audio/vocs.c

+12 −4

Original line number	Diff line number	Diff line
		@@ -53,6 +53,10 @@ static ssize_t write_location(struct bt_conn conn, const struct bt_gatt_attr a
		struct bt_vocs_server *inst = attr->user_data;
		uint32_t old_location = inst->location;

		if (offset) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
		}

		if (len != sizeof(inst->location)) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
		}
		@@ -91,6 +95,10 @@ static ssize_t write_vocs_control(struct bt_conn *conn, const struct bt_gatt_att
		const struct bt_vocs_control *cp = buf;
		bool notify = false;

		if (offset) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
		}

		if (!len \|\| !buf) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
		}
		@@ -101,10 +109,6 @@ static ssize_t write_vocs_control(struct bt_conn *conn, const struct bt_gatt_att
		return BT_GATT_ERR(BT_VOCS_ERR_OP_NOT_SUPPORTED);
		}

		if (offset) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
		}

		if (len != sizeof(struct bt_vocs_control)) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
		}
		@@ -160,6 +164,10 @@ static ssize_t write_output_desc(struct bt_conn *conn, const struct bt_gatt_attr
		{
		struct bt_vocs_server *inst = attr->user_data;

		if (offset) {
		return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
		}

		if (len >= sizeof(inst->output_desc)) {
		BT_DBG("Output desc was clipped from length %u to %zu",
		len, sizeof(inst->output_desc) - 1);