Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a13847ac authored by Rongxuan Liu's avatar Rongxuan Liu Committed by Gerrit Code Review
Browse files

Merge "[le audio] Prevent creating broadcast with all 0xFF broadcast code" into main

parents 640819fb e6d30316

system/bta/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -1191,6 +1191,7 @@ cc_test { 
        "libfmq",

        "libhidlbase",

        "liblog",

        "server_configurable_flags",

    ],

    static_libs: [

        "libbluetooth-types",

system/bta/le_audio/broadcaster/broadcaster.cc

+8 −0
Original line number Diff line number Diff line
@@ -492,6 +492,14 @@ public: 
    LeAudioLtvMap public_ltv;

    std::vector<LeAudioLtvMap> subgroup_ltvs;



    if (broadcast_code && std::all_of(broadcast_code->begin(), broadcast_code->end(),

                                      [](uint8_t byte) { return byte == 0xFF; })) {

      // As suggested by BASS ES-23366, all 0xFF broadcast code should be avoided for security

      log::error("Invalid all 0xFF broadcast code provided.");

      callbacks_->OnBroadcastCreated(bluetooth::le_audio::kBroadcastIdInvalid, false);

      return;

    }



    if (queued_create_broadcast_request_) {

      log::error("Not processed yet queued broadcast");

      callbacks_->OnBroadcastCreated(bluetooth::le_audio::kBroadcastIdInvalid, false);

system/bta/le_audio/broadcaster/broadcaster_test.cc

+22 −0
Original line number Diff line number Diff line
@@ -494,6 +494,28 @@ TEST_F(BroadcasterTest, CreateAudioBroadcast) { 
  // Note: There shall be a separate test to verify audio parameters

}



TEST_F(BroadcasterTest, CreateAudioBroadcastInvalidBroadcastCode) {

  std::optional<bluetooth::le_audio::BroadcastCode> invalid_broadcast_code =

          bluetooth::le_audio::BroadcastCode({0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,

                                              0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF});



  std::vector<std::vector<uint8_t>> metadata_array;

  for (uint8_t i = 0; i < default_subgroup_qualities.size(); i++) {

    // use the same default_metadata for each subgroup

    metadata_array.push_back(default_metadata);

  }



  EXPECT_CALL(mock_broadcaster_callbacks_,

              OnBroadcastCreated(bluetooth::le_audio::kBroadcastIdInvalid, false))

          .Times(1);

  // Add multiple subgroup settings with the same content

  LeAudioBroadcaster::Get()->CreateAudioBroadcast(true, test_broadcast_name, invalid_broadcast_code,

                                                  default_public_metadata,

                                                  default_subgroup_qualities, metadata_array);



  Mock::VerifyAndClearExpectations(&mock_broadcaster_callbacks_);

}



TEST_F(BroadcasterTest, CreateAudioBroadcastMultiGroups) {

  // Test with two subgroups

  auto broadcast_id = InstantiateBroadcast(