Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3fbae159 authored by TreeHugger Robot's avatar TreeHugger Robot Committed by Automerger Merge Worker
Browse files

Merge "le_audio: Guard ASE control point commands from invalid metadata" into tm-dev am: 212d32be 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/modules/Bluetooth/+/18582448



Change-Id: I657d9545146f42ae978b44020f358a08024f7542
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 7eb1ea7b 212d32be

system/bta/le_audio/client_parser.cc

+37 −8
Original line number Diff line number Diff line
@@ -31,8 +31,11 @@ 


#include "bta_le_audio_api.h"

#include "gap_api.h"

#include "gatt_api.h"

#include "gd/common/strings.h"

#include "le_audio_types.h"

#include "osi/include/allocator.h"

#include "osi/include/log.h"



using le_audio::types::acs_ac_record;
@@ -379,11 +382,24 @@ bool PrepareAseCtpEnable(const std::vector<struct ctp_enable>& confs, 
                         std::vector<uint8_t>& value) {

  if (confs.size() == 0) return false;



  if (confs.size() > UINT8_MAX) {

    LOG_ERROR(" To many ASEs to update metadata");

    return false;

  }



  uint16_t msg_len = confs.size() * kCtpEnableMinLen + kAseNumSize + kCtpOpSize;

  std::for_each(confs.begin(), confs.end(),

                [&msg_len](const struct ctp_enable& conf) {

  for (auto& conf : confs) {

    if (msg_len > GATT_MAX_ATTR_LEN) {

      LOG_ERROR(" Message length above GATT maximum");

      return false;

    }

    if (conf.metadata.size() > UINT8_MAX) {

      LOG_ERROR(" ase[%d] metadata length is invalid", conf.ase_id);

      return false;

    }



    msg_len += conf.metadata.size();

                });

  }

  value.resize(msg_len);



  uint8_t* msg = value.data();
@@ -466,12 +482,25 @@ bool PrepareAseCtpUpdateMetadata( 
    std::vector<uint8_t>& value) {

  if (confs.size() == 0) return false;



  if (confs.size() > UINT8_MAX) {

    LOG_ERROR(" To many ASEs to update metadata");

    return false;

  }



  uint16_t msg_len =

      confs.size() * kCtpUpdateMetadataMinLen + kAseNumSize + kCtpOpSize;

  std::for_each(confs.begin(), confs.end(),

                [&msg_len](const struct ctp_update_metadata& conf) {

  for (auto& conf : confs) {

    if (msg_len > GATT_MAX_ATTR_LEN) {

      LOG_ERROR(" Message length above GATT maximum");

      return false;

    }

    if (conf.metadata.size() > UINT8_MAX) {

      LOG_ERROR(" ase[%d] metadata length is invalid", conf.ase_id);

      return false;

    }



    msg_len += conf.metadata.size();

                });

  }

  value.resize(msg_len);



  uint8_t* msg = value.data();