Merge "le_audio: Guard ASE control point commands from invalid metadata" into tm-dev (212d32be) · Commits · e / os / android_packages_modules_Bluetooth

system/bta/le_audio/client_parser.cc

+37 −8

Original line number	Diff line number	Diff line
		@@ -31,8 +31,11 @@

		#include "bta_le_audio_api.h"
		#include "gap_api.h"
		#include "gatt_api.h"
		#include "gd/common/strings.h"
		#include "le_audio_types.h"
		#include "osi/include/allocator.h"
		#include "osi/include/log.h"

		using le_audio::types::acs_ac_record;

		@@ -379,11 +382,24 @@ bool PrepareAseCtpEnable(const std::vector<struct ctp_enable>& confs,
		std::vector<uint8_t>& value) {
		if (confs.size() == 0) return false;

		if (confs.size() > UINT8_MAX) {
		LOG_ERROR(" To many ASEs to update metadata");
		return false;
		}

		uint16_t msg_len = confs.size() * kCtpEnableMinLen + kAseNumSize + kCtpOpSize;
		std::for_each(confs.begin(), confs.end(),
		[&msg_len](const struct ctp_enable& conf) {
		for (auto& conf : confs) {
		if (msg_len > GATT_MAX_ATTR_LEN) {
		LOG_ERROR(" Message length above GATT maximum");
		return false;
		}
		if (conf.metadata.size() > UINT8_MAX) {
		LOG_ERROR(" ase[%d] metadata length is invalid", conf.ase_id);
		return false;
		}

		msg_len += conf.metadata.size();
		});
		}
		value.resize(msg_len);

		uint8_t* msg = value.data();
		@@ -466,12 +482,25 @@ bool PrepareAseCtpUpdateMetadata(
		std::vector<uint8_t>& value) {
		if (confs.size() == 0) return false;

		if (confs.size() > UINT8_MAX) {
		LOG_ERROR(" To many ASEs to update metadata");
		return false;
		}

		uint16_t msg_len =
		confs.size() * kCtpUpdateMetadataMinLen + kAseNumSize + kCtpOpSize;
		std::for_each(confs.begin(), confs.end(),
		[&msg_len](const struct ctp_update_metadata& conf) {
		for (auto& conf : confs) {
		if (msg_len > GATT_MAX_ATTR_LEN) {
		LOG_ERROR(" Message length above GATT maximum");
		return false;
		}
		if (conf.metadata.size() > UINT8_MAX) {
		LOG_ERROR(" ase[%d] metadata length is invalid", conf.ase_id);
		return false;
		}

		msg_len += conf.metadata.size();
		});
		}
		value.resize(msg_len);

		uint8_t* msg = value.data();