This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit be229e7269fe4ee3ebebee57394666a52a835b99 Author: Szymon Janc <[email protected]> AuthorDate: Tue May 12 14:17:46 2026 +0200 nimble/audio/bass: Fix Modify Source operation PDU parsing Num_Subgroups is 1 byte so adjust accordingly. Also validate received data while parising it. In case of error reject operation. --- .../bass/include/services/bass/ble_audio_svc_bass.h | 2 +- .../audio/services/bass/src/ble_audio_svc_bass.c | 21 +++++++++++++++------ 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h b/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h index 873ac7ae6..a037066ca 100644 --- a/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h +++ b/nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h @@ -325,7 +325,7 @@ struct ble_svc_audio_bass_operation { uint16_t pa_interval; /** Number of subgroups */ - uint16_t num_subgroups; + uint8_t num_subgroups; /** Subgroup entries */ struct ble_svc_audio_bass_subgroup diff --git a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c index c36655228..917240d92 100644 --- a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c +++ b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c @@ -516,20 +516,29 @@ ble_svc_audio_bass_modify_source(uint8_t *data, uint16_t data_len, uint16_t conn operation.modify_source.pa_interval = get_le16(&data[offset]); offset += 2; - operation.modify_source.num_subgroups = get_le16(&data[offset]); - offset += 2; + operation.modify_source.num_subgroups = data[offset++]; - data_len -= offset; - if (data_len < operation.modify_source.num_subgroups * sizeof(uint32_t)) { + if (operation.modify_source.num_subgroups > BLE_SVC_AUDIO_BASS_SUB_NUM_MAX) { rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; ev.bass_operation_status.status = BLE_HS_EREJECT; goto done; } + data_len -= offset; + /** + * Previous data was checked for it's size in `ble_svc_audio_bass_ctrl_point_write_access`. + * As bis_sync_state array may be of variable length, we need to check it separately + */ for (i = 0; i < operation.modify_source.num_subgroups; i++) { + /* bis_sync + metadata len */ + if (data_len < (sizeof(uint32_t) + sizeof(uint8_t))) { + rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; + ev.bass_operation_status.status = BLE_HS_EREJECT; + goto done; + } operation.modify_source.subgroups[i].bis_sync_state = get_le32(&data[offset]); - offset += 4; - operation.modify_source.subgroups[i].metadata_length = data[offset++]; + operation.modify_source.subgroups[i].metadata_length = data[offset + 4]; + offset += 5; data_len -= 5; if (data_len < operation.modify_source.subgroups[i].metadata_length) { rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;
