Skip to content

Commit 05dc860

Browse files
lylezhu2012kartben
authored andcommitted
Bluetooth: Classic: A2DP: Fix out of bounds issue
This is a negative detection. The conn index should be never out of bounds of the array `connection`. Because the size of the array is `CONFIG_BT_MAX_CONN`. To improve the readability, add a `__ASSERT` checking to check if the conn index is out of bounds. CID 487769 Signed-off-by: Lyle Zhu <[email protected]>
1 parent e586213 commit 05dc860

File tree

1 file changed

+7
-1
lines changed
  • subsys/bluetooth/host/classic

1 file changed

+7
-1
lines changed

subsys/bluetooth/host/classic/a2dp.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,13 @@ static int bt_a2dp_get_sep_caps(struct bt_a2dp *a2dp);
8080

8181
static struct bt_a2dp *a2dp_get_connection(struct bt_conn *conn)
8282
{
83-
struct bt_a2dp *a2dp = &connection[bt_conn_index(conn)];
83+
struct bt_a2dp *a2dp;
84+
size_t index;
85+
86+
index = (size_t)bt_conn_index(conn);
87+
__ASSERT(index < ARRAY_SIZE(connection), "Conn index is out of bounds");
88+
89+
a2dp = &connection[index];
8490

8591
if (a2dp->session.br_chan.chan.conn == NULL) {
8692
/* Clean the memory area before returning */

0 commit comments

Comments
 (0)