This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 1700705460261ce3ceb4bd00ee83d335e0e0a1d0 Author: Szymon Janc <[email protected]> AuthorDate: Tue May 12 14:05:23 2026 +0200 nimble/audio/bass: Fix parsing add source operation Check if enough data is present before parsing sub groups. --- .../host/audio/services/bass/src/ble_audio_svc_bass.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c index 62184accf..c36655228 100644 --- a/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c +++ b/nimble/host/audio/services/bass/src/ble_audio_svc_bass.c @@ -372,14 +372,15 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha */ data_len -= offset; for (i = 0; i < operation.add_source.num_subgroups; i++) { - if (data_len < sizeof(uint32_t)) { + /* bis_sync + metadata len */ + if (data_len < (sizeof(uint32_t) + sizeof(uint8_t))) { rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; ev.bass_operation_status.status = BLE_HS_EREJECT; goto done; } operation.add_source.subgroups[i].bis_sync_state = get_le32(&data[offset]); - offset += 4; - operation.add_source.subgroups[i].metadata_length = data[offset++]; + operation.add_source.subgroups[i].metadata_length = data[offset + 4]; + offset += 5; data_len -= 5; if (data_len < operation.add_source.subgroups[i].metadata_length) { rc = BLE_ATT_ERR_WRITE_REQ_REJECTED; @@ -389,13 +390,13 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha operation.add_source.subgroups[i].metadata = &data[offset]; offset += operation.add_source.subgroups[i].metadata_length; data_len -= operation.add_source.subgroups[i].metadata_length; + } - if (check_bis_sync(operation.add_source.num_subgroups, - operation.add_source.subgroups)) { - rc = BLE_HS_EINVAL; - ev.bass_operation_status.status = BLE_HS_EREJECT; - goto done; - } + if (check_bis_sync(operation.add_source.num_subgroups, + operation.add_source.subgroups)) { + rc = BLE_HS_EINVAL; + ev.bass_operation_status.status = BLE_HS_EREJECT; + goto done; } source_id_new = ble_svc_audio_bass_get_new_source_id();
