Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 27d53fb6 authored by Grzegorz Kołodziejczyk's avatar Grzegorz Kołodziejczyk
Browse files

le_audio: Guard ASE control point commands from invalid metadata 

Patch adds checks for metadata length and ASE count for control point
command.

Test: atest bluetooth_le_audio_test
Sponsor: @jpawlowski
Bug: 233069336
Change-Id: I26479550a90e3366299280cca30a5d27284bbef9
parent 634fb41d

system/bta/le_audio/client_parser.cc

+37 −8
Original line number Diff line number Diff line
@@ -31,8 +31,11 @@ 


#include "bta_le_audio_api.h"

#include "gap_api.h"

#include "gatt_api.h"

#include "gd/common/strings.h"

#include "le_audio_types.h"

#include "osi/include/allocator.h"

#include "osi/include/log.h"



using le_audio::types::acs_ac_record;
@@ -379,11 +382,24 @@ bool PrepareAseCtpEnable(const std::vector<struct ctp_enable>& confs, 
                         std::vector<uint8_t>& value) {

  if (confs.size() == 0) return false;



  if (confs.size() > UINT8_MAX) {

    LOG_ERROR(" To many ASEs to update metadata");

    return false;

  }



  uint16_t msg_len = confs.size() * kCtpEnableMinLen + kAseNumSize + kCtpOpSize;

  std::for_each(confs.begin(), confs.end(),

                [&msg_len](const struct ctp_enable& conf) {

  for (auto& conf : confs) {

    if (msg_len > GATT_MAX_ATTR_LEN) {

      LOG_ERROR(" Message length above GATT maximum");

      return false;

    }

    if (conf.metadata.size() > UINT8_MAX) {

      LOG_ERROR(" ase[%d] metadata length is invalid", conf.ase_id);

      return false;

    }



    msg_len += conf.metadata.size();

                });

  }

  value.resize(msg_len);



  uint8_t* msg = value.data();
@@ -466,12 +482,25 @@ bool PrepareAseCtpUpdateMetadata( 
    std::vector<uint8_t>& value) {

  if (confs.size() == 0) return false;



  if (confs.size() > UINT8_MAX) {

    LOG_ERROR(" To many ASEs to update metadata");

    return false;

  }



  uint16_t msg_len =

      confs.size() * kCtpUpdateMetadataMinLen + kAseNumSize + kCtpOpSize;

  std::for_each(confs.begin(), confs.end(),

                [&msg_len](const struct ctp_update_metadata& conf) {

  for (auto& conf : confs) {

    if (msg_len > GATT_MAX_ATTR_LEN) {

      LOG_ERROR(" Message length above GATT maximum");

      return false;

    }

    if (conf.metadata.size() > UINT8_MAX) {

      LOG_ERROR(" ase[%d] metadata length is invalid", conf.ase_id);

      return false;

    }



    msg_len += conf.metadata.size();

                });

  }

  value.resize(msg_len);



  uint8_t* msg = value.data();