This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit ae79cca826ce887de13ca2079c80966a215c5f5c Author: Szymon Janc <[email protected]> AuthorDate: Mon Oct 19 23:46:08 2026 +0200 nimble/audio/pacs: Fix NULL dereference on PAC read os_mbuf_extend() returns NULL if there is no memory, but its result was used unconditionally when reading Sink PAC and Source PAC characteristics. Return insufficient resources error instead. Assisted-by: Claude:claude-opus-5-5 --- nimble/host/audio/services/pacs/src/ble_audio_svc_pacs.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nimble/host/audio/services/pacs/src/ble_audio_svc_pacs.c b/nimble/host/audio/services/pacs/src/ble_audio_svc_pacs.c index ef53f94ac..9a90d8cb4 100644 --- a/nimble/host/audio/services/pacs/src/ble_audio_svc_pacs.c +++ b/nimble/host/audio/services/pacs/src/ble_audio_svc_pacs.c @@ -178,6 +178,10 @@ ble_svc_audio_pacs_sink_pac_read_access(struct ble_gatt_access_ctxt *ctxt) uint8_t *pac_count; pac_count = os_mbuf_extend(ctxt->om, sizeof(uint8_t)); + if (pac_count == NULL) { + return BLE_ATT_ERR_INSUFFICIENT_RES; + } + rc = ble_audio_codec_foreach(BLE_AUDIO_CODEC_DIR_SINK_BIT, codec_record_to_pacs_entry, (void *)&cb_arg); @@ -197,6 +201,10 @@ ble_svc_audio_pacs_source_pac_read_access(struct ble_gatt_access_ctxt *ctxt) uint8_t *pac_count; pac_count = os_mbuf_extend(ctxt->om, sizeof(uint8_t)); + if (pac_count == NULL) { + return BLE_ATT_ERR_INSUFFICIENT_RES; + } + rc = ble_audio_codec_foreach(BLE_AUDIO_CODEC_DIR_SOURCE_BIT, codec_record_to_pacs_entry, (void *)&cb_arg);
