Skip to content

Commit 5afc636

Browse files
ThalleyMaureenHelm
authored andcommitted
Bluetooth: BAP: Add check for num_subgroups in parse_recv_state
In the parse_recv_state we did not verify that we can handle all the subgroups before we started parsing them. Signed-off-by: Emil Gydesen <[email protected]> (cherry picked from commit edbe34e)
1 parent 6874cf5 commit 5afc636

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

subsys/bluetooth/audio/bap_broadcast_assistant.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include <zephyr/sys/check.h>
2424

2525
#include <zephyr/logging/log.h>
26+
#include <sys/errno.h>
2627

2728
LOG_MODULE_REGISTER(bt_bap_broadcast_assistant, CONFIG_BT_BAP_BROADCAST_ASSISTANT_LOG_LEVEL);
2829

@@ -143,6 +144,13 @@ static int parse_recv_state(const void *data, uint16_t length,
143144
}
144145

145146
recv_state->num_subgroups = net_buf_simple_pull_u8(&buf);
147+
if (recv_state->num_subgroups > CONFIG_BT_BAP_BASS_MAX_SUBGROUPS) {
148+
LOG_DBG("Cannot parse %u subgroups (max %d)", recv_state->num_subgroups,
149+
CONFIG_BT_BAP_BASS_MAX_SUBGROUPS);
150+
151+
return -ENOMEM;
152+
}
153+
146154
for (int i = 0; i < recv_state->num_subgroups; i++) {
147155
struct bt_bap_bass_subgroup *subgroup = &recv_state->subgroups[i];
148156
uint8_t *metadata;

0 commit comments

Comments
 (0)