Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11320c40 authored by Jakub Tyszkowski's avatar Jakub Tyszkowski
Browse files

Bass: Handle short broadcast codes 

Accept codes from 4 to 16 octets long and add padding zeros
in LSB positions.

Bug: 240929404
Fixes: 240929404
Test: atest BluetoothInstrumentationTests
Change-Id: Icabe59efcaa67ba1dd98f1783efffb2469f02b31
parent 8e2502ab

android/app/src/com/android/bluetooth/bass_client/BassClientService.java

+20 −0
Original line number Diff line number Diff line
@@ -1041,6 +1041,7 @@ public class BassClientService extends ProfileService { 
            return;

        }



        byte[] code = sourceMetadata.getBroadcastCode();

        for (BluetoothDevice device : devices) {

            BassClientStateMachine stateMachine = getOrCreateStateMachine(device);

            if (stateMachine == null) {
@@ -1070,6 +1071,15 @@ public class BassClientService extends ProfileService { 
                        BluetoothStatusCodes.ERROR_LE_BROADCAST_ASSISTANT_DUPLICATE_ADDITION);

                continue;

            }

            if ((code != null) && (code.length != 0)) {

                if ((code.length > 16) || (code.length < 4)) {

                    log("Invalid broadcast code length: " + code.length

                            + ", should be between 4 and 16 octets");

                    mCallbacks.notifySourceAddFailed(device, sourceMetadata,

                            BluetoothStatusCodes.ERROR_BAD_PARAMETERS);

                    continue;

                }

            }



            if (isGroupOp) {

                enqueueSourceGroupOp(device, BassClientStateMachine.ADD_BCAST_SOURCE,
@@ -1104,6 +1114,7 @@ public class BassClientService extends ProfileService { 
            return;

        }



        byte[] code = updatedMetadata.getBroadcastCode();

        for (Map.Entry<BluetoothDevice, Integer> deviceSourceIdPair : devices.entrySet()) {

            BluetoothDevice device = deviceSourceIdPair.getKey();

            Integer deviceSourceId = deviceSourceIdPair.getValue();
@@ -1127,6 +1138,15 @@ public class BassClientService extends ProfileService { 
                        BluetoothStatusCodes.ERROR_REMOTE_LINK_ERROR);

                continue;

            }

            if ((code != null) && (code.length != 0)) {

                if ((code.length > 16) || (code.length < 4)) {

                    log("Invalid broadcast code length: " + code.length

                            + ", should be between 4 and 16 octets");

                    mCallbacks.notifySourceModifyFailed(device, sourceId,

                            BluetoothStatusCodes.ERROR_BAD_PARAMETERS);

                    continue;

                }

            }

            if (stateMachine.hasPendingSourceOperation()) {

                throw new IllegalStateException("modifySource: source operation already pending");

            }

android/app/src/com/android/bluetooth/bass_client/BassClientStateMachine.java

+8 −10
Original line number Diff line number Diff line
@@ -1294,16 +1294,6 @@ public class BassClientStateMachine extends StateMachine { 
            stream.write(metadata.getRawMetadata(), 0, metadata.getRawMetadata().length);

        }



        if (metaData.isEncrypted() && metaData.getBroadcastCode().length == 16) {

            if (metaData.getBroadcastCode().length != 16) {

                Log.e(TAG, "Delivered invalid length of broadcast code: " +

                      metaData.getBroadcastCode().length + ", should be 16");

                return null;

            }



            mSetBroadcastCodePending = true;

        }



        byte[] res = stream.toByteArray();

        log("ADD_BCAST_SOURCE in Bytes");

        BassUtils.printByteArray(res);
@@ -1411,6 +1401,8 @@ public class BassClientStateMachine extends StateMachine { 
            log("byte array broadcast Code:" + Arrays.toString(actualPIN));

            log("pinLength:" + actualPIN.length);

            // Broadcast_Code, Fill the PIN code in the Last Position

            // This effectively adds padding zeros to LSB positions when the broadcast code

            // is shorter than 16 octets

            System.arraycopy(

                    actualPIN, 0, res,

                    (BassConstants.PIN_CODE_CMD_LEN - actualPIN.length), actualPIN.length);
@@ -1547,6 +1539,9 @@ public class BassClientStateMachine extends StateMachine { 
                        mBluetoothGatt.writeCharacteristic(mBroadcastScanControlPoint);

                        mPendingOperation = message.what;

                        mPendingMetadata = metaData;

                        if (metaData.isEncrypted() && (metaData.getBroadcastCode() != null)) {

                            mSetBroadcastCodePending = true;

                        }

                        transitionTo(mConnectedProcessing);

                        sendMessageDelayed(GATT_TXN_TIMEOUT, BassConstants.GATT_TXN_TIMEOUT_MS);

                    } else {
@@ -1574,6 +1569,9 @@ public class BassClientStateMachine extends StateMachine { 
                        if (paSync == BluetoothLeBroadcastReceiveState.PA_SYNC_STATE_IDLE) {

                            setPendingRemove(sourceId, true);

                        }

                        if (metaData.isEncrypted() && (metaData.getBroadcastCode() != null)) {

                            mSetBroadcastCodePending = true;

                        }

                        mPendingMetadata = metaData;

                        transitionTo(mConnectedProcessing);

                        sendMessageDelayed(GATT_TXN_TIMEOUT, BassConstants.GATT_TXN_TIMEOUT_MS);