Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6252ace3 authored by Pavlin Radoslavov's avatar Pavlin Radoslavov
Browse files

Add additional checks for AVDTP Codec Capabilities 

Reject AVDTP Codec Capabilities that contain invalid fields

Bug: 110918549
Test: Manual - connect to a device that sends invalid codec capability
Change-Id: Ib697cc9ad13ed666fbafa9219447592fe3f56684
parent 5c9ab99a

system/stack/a2dp/a2dp_aac.cc

+12 −1
Original line number Diff line number Diff line
@@ -191,7 +191,18 @@ static tA2DP_STATUS A2DP_ParseInfoAac(tA2DP_AAC_CIE* p_ie, 
                  (*(p_codec_info + 2) & A2DP_AAC_BIT_RATE_MASK2);

  p_codec_info += 3;



  if (is_capability) return A2DP_SUCCESS;

  if (is_capability) {

    // NOTE: The checks here are very liberal. We should be using more

    // pedantic checks specific to the SRC or SNK as specified in the spec.

    if (A2DP_BitsSet(p_ie->objectType) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_OBJ_TYPE;

    if (A2DP_BitsSet(p_ie->sampleRate) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_SAMP_FREQ;

    if (A2DP_BitsSet(p_ie->channelMode) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_CH_MODE;



    return A2DP_SUCCESS;

  }



  if (A2DP_BitsSet(p_ie->objectType) != A2DP_SET_ONE_BIT)

    return A2DP_BAD_OBJ_TYPE;

system/stack/a2dp/a2dp_sbc.cc

+16 −1
Original line number Diff line number Diff line
@@ -197,7 +197,22 @@ static tA2DP_STATUS A2DP_ParseInfoSbc(tA2DP_SBC_CIE* p_ie, 
    return A2DP_BAD_MAX_BITPOOL;

  }



  if (is_capability) return A2DP_SUCCESS;

  if (is_capability) {

    // NOTE: The checks here are very liberal. We should be using more

    // pedantic checks specific to the SRC or SNK as specified in the spec.

    if (A2DP_BitsSet(p_ie->samp_freq) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_SAMP_FREQ;

    if (A2DP_BitsSet(p_ie->ch_mode) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_CH_MODE;

    if (A2DP_BitsSet(p_ie->block_len) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_BLOCK_LEN;

    if (A2DP_BitsSet(p_ie->num_subbands) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_SUBBANDS;

    if (A2DP_BitsSet(p_ie->alloc_method) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_ALLOC_METHOD;



    return A2DP_SUCCESS;

  }



  if (A2DP_BitsSet(p_ie->samp_freq) != A2DP_SET_ONE_BIT)

    return A2DP_BAD_SAMP_FREQ;

system/stack/a2dp/a2dp_vendor_aptx.cc

+10 −1
Original line number Diff line number Diff line
@@ -155,7 +155,16 @@ static tA2DP_STATUS A2DP_ParseInfoAptx(tA2DP_APTX_CIE* p_ie, 
  p_ie->sampleRate = *p_codec_info & 0xF0;

  p_codec_info++;



  if (is_capability) return A2DP_SUCCESS;

  if (is_capability) {

    // NOTE: The checks here are very liberal. We should be using more

    // pedantic checks specific to the SRC or SNK as specified in the spec.

    if (A2DP_BitsSet(p_ie->sampleRate) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_SAMP_FREQ;

    if (A2DP_BitsSet(p_ie->channelMode) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_CH_MODE;



    return A2DP_SUCCESS;

  }



  if (A2DP_BitsSet(p_ie->sampleRate) != A2DP_SET_ONE_BIT)

    return A2DP_BAD_SAMP_FREQ;

system/stack/a2dp/a2dp_vendor_aptx_hd.cc

+10 −1
Original line number Diff line number Diff line
@@ -171,7 +171,16 @@ static tA2DP_STATUS A2DP_ParseInfoAptxHd(tA2DP_APTX_HD_CIE* p_ie, 
  p_ie->acl_sprint_reserved2 = *(p_codec_info++);

  p_ie->acl_sprint_reserved3 = *(p_codec_info++);



  if (is_capability) return A2DP_SUCCESS;

  if (is_capability) {

    // NOTE: The checks here are very liberal. We should be using more

    // pedantic checks specific to the SRC or SNK as specified in the spec.

    if (A2DP_BitsSet(p_ie->sampleRate) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_SAMP_FREQ;

    if (A2DP_BitsSet(p_ie->channelMode) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_CH_MODE;



    return A2DP_SUCCESS;

  }



  if (A2DP_BitsSet(p_ie->sampleRate) != A2DP_SET_ONE_BIT)

    return A2DP_BAD_SAMP_FREQ;

system/stack/a2dp/a2dp_vendor_ldac.cc

+10 −1
Original line number Diff line number Diff line
@@ -162,7 +162,16 @@ static tA2DP_STATUS A2DP_ParseInfoLdac(tA2DP_LDAC_CIE* p_ie, 
  p_ie->sampleRate = *p_codec_info++ & A2DP_LDAC_SAMPLING_FREQ_MASK;

  p_ie->channelMode = *p_codec_info++ & A2DP_LDAC_CHANNEL_MODE_MASK;



  if (is_capability) return A2DP_SUCCESS;

  if (is_capability) {

    // NOTE: The checks here are very liberal. We should be using more

    // pedantic checks specific to the SRC or SNK as specified in the spec.

    if (A2DP_BitsSet(p_ie->sampleRate) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_SAMP_FREQ;

    if (A2DP_BitsSet(p_ie->channelMode) == A2DP_SET_ZERO_BIT)

      return A2DP_BAD_CH_MODE;



    return A2DP_SUCCESS;

  }



  if (A2DP_BitsSet(p_ie->sampleRate) != A2DP_SET_ONE_BIT)

    return A2DP_BAD_SAMP_FREQ;