This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 24c17b6b211b7175a099be08760d2a83b317789d Author: Szymon Janc <[email protected]> AuthorDate: Tue May 12 13:23:55 2026 +0200 nimble/audio/bass: Check number of subgroups in Add Source operation Reject operation if number of subgroups exceeds maximum supported. --- nimble/host/audio/services/bass/src/ble_audio_svc_bass.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c index 61c03f8c3..62184accf 100644 --- a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c +++ b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c @@ -360,6 +360,12 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha offset += 2; operation.add_source.num_subgroups = data[offset++]; + if (operation.add_source.num_subgroups > BLE_SVC_AUDIO_BASS_SUB_NUM_MAX) { + rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; + ev.bass_operation_status.status = BLE_HS_EREJECT; + goto done; + } + /** * Previous data was checked for it's size in `ble_svc_audio_bass_ctrl_point_write_access`. * As bis_sync_state array may be of variable length, we need to check it separately
