@@ -1773,11 +1773,89 @@ static int sdp_client_ss_search(struct bt_sdp_client *session,
1773
1773
return bt_sdp_send (& session -> chan .chan , buf , BT_SDP_SVC_SEARCH_REQ , session -> tid );
1774
1774
}
1775
1775
1776
+ static uint16_t sdp_client_get_attribute_id_list_len (struct bt_sdp_attribute_id_list * ids )
1777
+ {
1778
+ uint16_t len = 0 ;
1779
+
1780
+ if (ids == NULL || ids -> count == 0 ) {
1781
+ return sizeof (uint8_t ) + sizeof (uint32_t );
1782
+ }
1783
+
1784
+ for (size_t i = 0 ; i < ids -> count ; i ++ ) {
1785
+ if (ids -> ranges [i ].beginning == ids -> ranges [i ].ending ) {
1786
+ len += sizeof (uint8_t ) + sizeof (uint16_t );
1787
+ } else {
1788
+ len += sizeof (uint8_t ) + sizeof (uint32_t );
1789
+ }
1790
+ }
1791
+
1792
+ return len ;
1793
+ }
1794
+
1795
+ static void sdp_client_add_attribute_id (struct net_buf * buf , struct bt_sdp_attribute_id_list * ids )
1796
+ {
1797
+ uint16_t len ;
1798
+
1799
+ len = sdp_client_get_attribute_id_list_len (ids );
1800
+ /*
1801
+ * Sequence definition where data is sequence of elements and where
1802
+ * additional next byte points the size of elements within
1803
+ */
1804
+ if (len > UINT8_MAX ) {
1805
+ net_buf_add_u8 (buf , BT_SDP_SEQ16 );
1806
+ net_buf_add_be16 (buf , len );
1807
+ } else {
1808
+ net_buf_add_u8 (buf , BT_SDP_SEQ8 );
1809
+ net_buf_add_u8 (buf , len );
1810
+ }
1811
+
1812
+ if (ids == NULL || ids -> count == 0 ) {
1813
+ /* Data element definition for two following 16bits range elements */
1814
+ net_buf_add_u8 (buf , BT_SDP_UINT32 );
1815
+ /* Get all attributes. It enables filter out wanted only attributes */
1816
+ net_buf_add_be16 (buf , 0x0000 );
1817
+ net_buf_add_be16 (buf , 0xffff );
1818
+ return ;
1819
+ }
1820
+
1821
+ for (size_t i = 0 ; i < ids -> count ; i ++ ) {
1822
+ if (ids -> ranges [i ].beginning == ids -> ranges [i ].ending ) {
1823
+ /* Data element definition for one following 16bits range elements */
1824
+ net_buf_add_u8 (buf , BT_SDP_UINT16 );
1825
+ /* Get all attributes. It enables filter out wanted only attributes */
1826
+ net_buf_add_be16 (buf , ids -> ranges [i ].beginning );
1827
+ } else {
1828
+ /* Data element definition for two following 16bits range elements */
1829
+ net_buf_add_u8 (buf , BT_SDP_UINT32 );
1830
+ /* Get all attributes. It enables filter out wanted only attributes */
1831
+ net_buf_add_be16 (buf , ids -> ranges [i ].beginning );
1832
+ net_buf_add_be16 (buf , ids -> ranges [i ].ending );
1833
+ }
1834
+ }
1835
+ }
1836
+
1837
+ static uint16_t sdp_client_get_total_len (struct bt_sdp_client * session ,
1838
+ const struct bt_sdp_discover_params * param )
1839
+ {
1840
+ uint16_t len ;
1841
+
1842
+ len = sdp_client_get_attribute_id_list_len (param -> ids );
1843
+ if (len > UINT8_MAX ) {
1844
+ len += sizeof (uint8_t ) + sizeof (uint16_t );
1845
+ } else {
1846
+ len += sizeof (uint8_t ) + sizeof (uint8_t );
1847
+ }
1848
+ len += sizeof (session -> cstate .length ) + session -> cstate .length ;
1849
+
1850
+ return len ;
1851
+ }
1852
+
1776
1853
/* ServiceAttribute PDU, ref to BT Core 5.4, Vol 3, part B, 4.6.1 */
1777
1854
static int sdp_client_sa_search (struct bt_sdp_client * session ,
1778
1855
const struct bt_sdp_discover_params * param )
1779
1856
{
1780
1857
struct net_buf * buf ;
1858
+ uint16_t len ;
1781
1859
1782
1860
/* Update context param directly. */
1783
1861
session -> param = param ;
@@ -1789,17 +1867,17 @@ static int sdp_client_sa_search(struct bt_sdp_client *session,
1789
1867
1790
1868
/* Set attribute max bytes count to be returned from server */
1791
1869
net_buf_add_be16 (buf , net_buf_tailroom (session -> rec_buf ));
1792
- /*
1793
- * Sequence definition where data is sequence of elements and where
1794
- * additional next byte points the size of elements within
1795
- */
1796
- net_buf_add_u8 ( buf , BT_SDP_SEQ8 );
1797
- net_buf_add_u8 (buf , 0x05 );
1798
- /* Data element definition for two following 16bits range elements */
1799
- net_buf_add_u8 ( buf , BT_SDP_UINT32 );
1800
- /* Get all attributes. It enables filter out wanted only attributes */
1801
- net_buf_add_be16 ( buf , 0x0000 );
1802
- net_buf_add_be16 (buf , 0xffff );
1870
+
1871
+ /* Check the tailroom of the buffer */
1872
+ len = sdp_client_get_total_len ( session , param );
1873
+ if ( len > net_buf_tailroom ( buf )) {
1874
+ LOG_ERR ( "No space to add attribute ID" );
1875
+ net_buf_unref (buf );
1876
+ return - ENOMEM ;
1877
+ }
1878
+
1879
+ /* Add attribute ID List */
1880
+ sdp_client_add_attribute_id (buf , param -> ids );
1803
1881
1804
1882
/*
1805
1883
* Update and validate PDU ContinuationState. Initial SSA Request has
@@ -1825,6 +1903,7 @@ static int sdp_client_ssa_search(struct bt_sdp_client *session,
1825
1903
{
1826
1904
struct net_buf * buf ;
1827
1905
uint8_t uuid128 [BT_UUID_SIZE_128 ];
1906
+ uint16_t len ;
1828
1907
1829
1908
/* Update context param directly. */
1830
1909
session -> param = param ;
@@ -1862,17 +1941,17 @@ static int sdp_client_ssa_search(struct bt_sdp_client *session,
1862
1941
1863
1942
/* Set attribute max bytes count to be returned from server */
1864
1943
net_buf_add_be16 (buf , net_buf_tailroom (session -> rec_buf ));
1865
- /*
1866
- * Sequence definition where data is sequence of elements and where
1867
- * additional next byte points the size of elements within
1868
- */
1869
- net_buf_add_u8 ( buf , BT_SDP_SEQ8 );
1870
- net_buf_add_u8 (buf , 0x05 );
1871
- /* Data element definition for two following 16bits range elements */
1872
- net_buf_add_u8 ( buf , BT_SDP_UINT32 );
1873
- /* Get all attributes. It enables filter out wanted only attributes */
1874
- net_buf_add_be16 ( buf , 0x0000 );
1875
- net_buf_add_be16 (buf , 0xffff );
1944
+
1945
+ /* Check the tailroom of the buffer */
1946
+ len = sdp_client_get_total_len ( session , param );
1947
+ if ( len > net_buf_tailroom ( buf )) {
1948
+ LOG_ERR ( "No space to add attribute ID" );
1949
+ net_buf_unref (buf );
1950
+ return - ENOMEM ;
1951
+ }
1952
+
1953
+ /* Add attribute ID List */
1954
+ sdp_client_add_attribute_id (buf , param -> ids );
1876
1955
1877
1956
/*
1878
1957
* Update and validate PDU ContinuationState. Initial SSA Request has
@@ -2714,11 +2793,27 @@ static int sdp_client_discovery_start(struct bt_conn *conn,
2714
2793
int bt_sdp_discover (struct bt_conn * conn ,
2715
2794
struct bt_sdp_discover_params * params )
2716
2795
{
2717
- if (!params || !params -> uuid || !params -> func || !params -> pool ) {
2796
+ if (params == NULL || params -> uuid == NULL || params -> func == NULL ||
2797
+ params -> pool == NULL ||
2798
+ (params -> ids != NULL && params -> ids -> count != 0 && params -> ids -> ranges == NULL )) {
2718
2799
LOG_WRN ("Invalid user params" );
2719
2800
return - EINVAL ;
2720
2801
}
2721
2802
2803
+ if (params -> ids != NULL ) {
2804
+ for (size_t i = 0 ; i < params -> ids -> count ; i ++ ) {
2805
+ struct bt_sdp_attribute_id_range * range ;
2806
+
2807
+ range = & params -> ids -> ranges [i ];
2808
+ if (range -> beginning <= range -> ending ) {
2809
+ continue ;
2810
+ }
2811
+
2812
+ LOG_WRN ("Invalid range %u > %u" , range -> beginning , range -> ending );
2813
+ return - EINVAL ;
2814
+ }
2815
+ }
2816
+
2722
2817
return sdp_client_discovery_start (conn , params );
2723
2818
}
2724
2819
0 commit comments