Bluetooth: audio: Fix metadata length checks

MariuszSkamra · carlescufi · commit 17223f136fb7 · 2023-06-29T21:06:58.000+02:00
This fixes metadata length checks for BT_AUDIO_METADATA_TYPE_EXTENDED
and BT_AUDIO_METADATA_TYPE_VENDOR that should be at least 2 bytes long.

Signed-off-by: Mariusz Skamra &lt;mariusz.skamra@codecoup.pl&gt;
diff --git a/samples/bluetooth/hap_ha/src/bap_unicast_sr.c b/samples/bluetooth/hap_ha/src/bap_unicast_sr.c
@@ -290,9 +290,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 
diff --git a/samples/bluetooth/tmap_peripheral/src/bap_unicast_sr.c b/samples/bluetooth/tmap_peripheral/src/bap_unicast_sr.c
@@ -239,9 +239,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 
diff --git a/samples/bluetooth/unicast_audio_server/src/main.c b/samples/bluetooth/unicast_audio_server/src/main.c
@@ -431,9 +431,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 
diff --git a/subsys/bluetooth/audio/shell/bap.c b/subsys/bluetooth/audio/shell/bap.c
@@ -511,9 +511,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 
diff --git a/tests/bluetooth/tester/src/btp_bap.c b/tests/bluetooth/tester/src/btp_bap.c
@@ -353,9 +353,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len, const uint8_t *data)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 
diff --git a/tests/bsim/bluetooth/audio/src/bap_unicast_server_test.c b/tests/bsim/bluetooth/audio/src/bap_unicast_server_test.c
@@ -182,9 +182,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR:   /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 
diff --git a/tests/bsim/bluetooth/audio/src/cap_acceptor_test.c b/tests/bsim/bluetooth/audio/src/cap_acceptor_test.c
@@ -347,9 +347,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)
 		}
 
 		return true;
-	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */
-	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */
-		if (len < 1) {
+	case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */
+	case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */
+		/* At least Extended Metadata Type / Company_ID should be there */
+		if (len < 2) {
 			return false;
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -290,9 +290,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)`
`290`	`290`	`}`
`291`	`291`
`292`	`292`	`return true;`
`293`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`294`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`295`		`- if (len < 1) {`
	`293`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`294`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`295`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`296`	`+ if (len < 2) {`
`296`	`297`	`return false;`
`297`	`298`	`}`
`298`	`299`
Original file line number	Diff line number	Diff line change
`@@ -239,9 +239,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)`
`239`	`239`	`}`
`240`	`240`
`241`	`241`	`return true;`
`242`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`243`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`244`		`- if (len < 1) {`
	`242`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`243`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`244`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`245`	`+ if (len < 2) {`
`245`	`246`	`return false;`
`246`	`247`	`}`
`247`	`248`
Original file line number	Diff line number	Diff line change
`@@ -431,9 +431,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)`
`431`	`431`	`}`
`432`	`432`
`433`	`433`	`return true;`
`434`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`435`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`436`		`- if (len < 1) {`
	`434`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`435`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`436`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`437`	`+ if (len < 2) {`
`437`	`438`	`return false;`
`438`	`439`	`}`
`439`	`440`
Original file line number	Diff line number	Diff line change
`@@ -511,9 +511,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)`
`511`	`511`	`}`
`512`	`512`
`513`	`513`	`return true;`
`514`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`515`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`516`		`- if (len < 1) {`
	`514`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`515`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`516`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`517`	`+ if (len < 2) {`
`517`	`518`	`return false;`
`518`	`519`	`}`
`519`	`520`
Original file line number	Diff line number	Diff line change
`@@ -353,9 +353,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len, const uint8_t *data)`
`353`	`353`	`}`
`354`	`354`
`355`	`355`	`return true;`
`356`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`357`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`358`		`- if (len < 1) {`
	`356`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`357`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`358`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`359`	`+ if (len < 2) {`
`359`	`360`	`return false;`
`360`	`361`	`}`
`361`	`362`
Original file line number	Diff line number	Diff line change
`@@ -182,9 +182,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)`
`182`	`182`	`}`
`183`	`183`
`184`	`184`	`return true;`
`185`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`186`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`187`		`- if (len < 1) {`
	`185`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`186`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`187`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`188`	`+ if (len < 2) {`
`188`	`189`	`return false;`
`189`	`190`	`}`
`190`	`191`
Original file line number	Diff line number	Diff line change
`@@ -347,9 +347,10 @@ static bool valid_metadata_type(uint8_t type, uint8_t len)`
`347`	`347`	`}`
`348`	`348`
`349`	`349`	`return true;`
`350`		`- case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 1 - 255 octets */`
`351`		`- case BT_AUDIO_METADATA_TYPE_VENDOR: /* 1 - 255 octets */`
`352`		`- if (len < 1) {`
	`350`	`+ case BT_AUDIO_METADATA_TYPE_EXTENDED: /* 2 - 255 octets */`
	`351`	`+ case BT_AUDIO_METADATA_TYPE_VENDOR: /* 2 - 255 octets */`
	`352`	`+ /* At least Extended Metadata Type / Company_ID should be there */`
	`353`	`+ if (len < 2) {`
`353`	`354`	`return false;`
`354`	`355`	`}`
`355`	`356`