This is an automated email from the ASF dual-hosted git repository.
rymek pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
The following commit(s) were added to refs/heads/master by this push:
new 80d95d0d0 nimble/audio/bass: Modify add source operation in BASS
80d95d0d0 is described below
commit 80d95d0d0b19b4b6b26c0edcd53ad04f43328eb7
Author: Szymon Czapracki <[email protected]>
AuthorDate: Fri Aug 9 15:44:16 2024 +0200
nimble/audio/bass: Modify add source operation in BASS
Fix memcpy wrong field format from address.
Move check_bis_sync up, so add source can use it.
Add checks for address type.
Add checks for advertising sid.
Add pa_sync_state and num of subgroups to receive state.
---
.../include/services/bass/ble_audio_svc_bass.h | 3 +
.../audio/services/bass/src/ble_audio_svc_bass.c | 66 ++++++++++++++--------
2 files changed, 46 insertions(+), 23 deletions(-)
diff --git
a/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h
b/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h
index 431ecb968..155df24a5 100644
--- a/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h
+++ b/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h
@@ -71,6 +71,9 @@
/** BLE AUDIO BASS Error: Invalid Source ID */
#define BLE_SVC_AUDIO_BASS_ERR_INVALID_SOURCE_ID 0x81
+/** BLE AUDIO BASS ADVERTISING SID MAX VALUE */
+#define BLE_SVC_AUDIO_BASS_ADV_SID_MAX_VAL 0x0F
+
/** BLE AUDIO BASS Encryption States */
enum ble_svc_audio_bass_big_enc {
/** BLE AUDIO BASS BIG Encryption: Not Encrypted */
diff --git a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c
b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c
index 451b766dd..c18a276b3 100644
--- a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c
+++ b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c
@@ -282,6 +282,28 @@ ble_svc_audio_bass_remote_scan_started(uint8_t *data,
uint16_t data_len, uint16_
return 0;
}
+static int
+check_bis_sync(uint16_t num_subgroups, const uint32_t *bis_sync_list)
+{
+ uint32_t bis_sync_mask = 0;
+ int i;
+ int j;
+
+ for (i = 0; i < num_subgroups; i++) {
+ if (bis_sync_list[i] != 0xFFFFFFFF) {
+ for (j = 0; j < num_subgroups; j++) {
+ if (bis_sync_list[i] & bis_sync_mask) {
+ return BLE_HS_EINVAL;
+ }
+
+ bis_sync_mask |= bis_sync_list[i];
+ }
+ }
+ }
+
+ return 0;
+}
+
static int
ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t
conn_handle)
{
@@ -307,9 +329,21 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t
data_len, uint16_t conn_ha
operation.conn_handle = conn_handle;
operation.add_source.adv_addr.type = data[offset++];
+ if (operation.add_source.adv_addr.type != BLE_ADDR_PUBLIC ||
+ operation.add_source.adv_addr.type != BLE_ADDR_RANDOM) {
+ rc = BLE_HS_EINVAL;
+ ev.bass_operation_status.status = BLE_HS_EINVAL;
+ goto done;
+ }
memcpy(operation.add_source.adv_addr.val, &data[offset], 6);
offset += 6;
operation.add_source.adv_sid = data[offset++];
+ if (operation.add_source.adv_sid > BLE_SVC_AUDIO_BASS_ADV_SID_MAX_VAL) {
+ rc = BLE_HS_EINVAL;
+ ev.bass_operation_status.status = BLE_HS_EINVAL;
+ goto done;
+ }
+
operation.add_source.broadcast_id = get_le24(&data[offset]);
offset += 3;
operation.add_source.pa_sync = data[offset++];
@@ -346,6 +380,13 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t
data_len, uint16_t conn_ha
operation.add_source.subgroups[i].metadata = &data[offset];
offset += operation.add_source.subgroups[i].metadata_length;
data_len -= operation.add_source.subgroups[i].metadata_length;
+
+ if (check_bis_sync(operation.add_source.num_subgroups,
+ operation.add_source.bis_sync)) {
+ rc = BLE_HS_EINVAL;
+ ev.bass_operation_status.status = BLE_HS_EREJECT;
+ goto done;
+ }
}
source_id_new = ble_svc_audio_bass_get_new_source_id();
@@ -393,9 +434,10 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t
data_len, uint16_t conn_ha
ev.bass_operation_status.source_id = rcv_state->source_id;
rcv_state->state.source_addr.type = operation.add_source.adv_addr.type;
- memcpy(&rcv_state->state.source_addr.type,
operation.add_source.adv_addr.val, 6);
+ memcpy(&rcv_state->state.source_addr.val,
operation.add_source.adv_addr.val, 6);
rcv_state->state.source_adv_sid = operation.add_source.adv_sid;
rcv_state->state.broadcast_id = operation.add_source.broadcast_id;
+ rcv_state->state.num_subgroups = operation.add_source.num_subgroups;
for (i = 0; i < operation.add_source.num_subgroups; i++) {
metadata_ptr = os_memblock_get(&ble_audio_svc_bass_metadata_pool);
@@ -423,28 +465,6 @@ done:
return rc;
}
-static int
-check_bis_sync(uint16_t num_subgroups, const uint32_t *bis_sync_list)
-{
- uint32_t bis_sync_mask = 0;
- int i;
- int j;
-
- for (i = 0; i < num_subgroups; i++) {
- if (bis_sync_list[i] != 0xFFFFFFFF) {
- for (j = 0; j < num_subgroups; j++) {
- if (bis_sync_list[i] & bis_sync_mask) {
- return BLE_HS_EINVAL;
- }
-
- bis_sync_mask |= bis_sync_list[i];
- }
- }
- }
-
- return 0;
-}
-
static int
ble_svc_audio_bass_modify_source(uint8_t *data, uint16_t data_len, uint16_t
conn_handle)
{
