Skip to content

Commit ef0846e

Browse files
ThalleyThalley
committed
DNM: Add checks for UTF when setting and getting broadcast name.
Signed-off-by: Emil Gydesen <[email protected]>
1 parent 1d6b675 commit ef0846e

File tree

6 files changed

+134
-5
lines changed

6 files changed

+134
-5
lines changed

‎include/zephyr/bluetooth/assigned_numbers.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1064,10 +1064,14 @@ enum bt_audio_codec_cap_chan_count {
10641064
/** Maximum supported channel counts */
10651065
#define BT_AUDIO_CODEC_CAP_CHAN_COUNT_MAX 8
10661066

1067-
/** The minimum size of a Broadcast Name as defined by Bluetooth Assigned Numbers */
1067+
/** The minimum size in octets of a Broadcast Name */
10681068
#define BT_AUDIO_BROADCAST_NAME_LEN_MIN 4
1069-
/** The maximum size of a Broadcast Name as defined by Bluetooth Assigned Numbers */
1069+
/** The maximum size in octets of a Broadcast Name */
10701070
#define BT_AUDIO_BROADCAST_NAME_LEN_MAX 128
1071+
/** The minimum amount of characters of a Broadcast Name */
1072+
#define BT_AUDIO_BROADCAST_NAME_CHAR_MIN 4
1073+
/** The maximum amount of characters of a Broadcast Name */
1074+
#define BT_AUDIO_BROADCAST_NAME_CHAR_MAX 32
10711075

10721076
/**
10731077
* @brief Codec configuration types

‎include/zephyr/bluetooth/audio/audio.h‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ extern "C" {
5151
/** Indicates that the unicast server does not have a preference for any retransmission number */
5252
#define BT_AUDIO_RTN_PREF_NONE 0xFFU
5353

54+
/** The minimum amount of characters of a Broadcast Name as defined by Bluetooth Assigned Numbers */
55+
#define BT_AUDIO_BROADCAST_NAME_CHAR_MIN 4
56+
/** The maximum amount of characters of a Broadcast Name as defined by Bluetooth Assigned Numbers */
57+
#define BT_AUDIO_BROADCAST_NAME_CHAR_MAX 32
58+
5459
/** Size of the stream language value, e.g. "eng" */
5560
#define BT_AUDIO_LANG_SIZE 3
5661

@@ -928,7 +933,9 @@ int bt_audio_codec_cfg_meta_get_broadcast_name(const struct bt_audio_codec_cfg *
928933
*
929934
* @param codec_cfg The codec configuration to set data for.
930935
* @param broadcast_name The broadcast name to set.
931-
* @param broadcast_name_len The length of @p broadcast_name.
936+
* @param broadcast_name_len The length of @p broadcast_name. Shall be between
937+
* @ref BT_AUDIO_BROADCAST_NAME_LEN_MIN and
938+
* @ref BT_AUDIO_BROADCAST_NAME_LEN_MAX.
932939
*
933940
* @retval data_len The @p codec_cfg.data_len on success
934941
* @retval -EINVAL Arguments are invalid
@@ -1530,7 +1537,9 @@ int bt_audio_codec_cap_meta_get_broadcast_name(const struct bt_audio_codec_cap *
15301537
*
15311538
* @param codec_cap The codec capability to set data for.
15321539
* @param broadcast_name The broadcast name to set.
1533-
* @param broadcast_name_len The length of @p broadcast_name.
1540+
* @param broadcast_name_len The length of @p broadcast_name. Shall be between
1541+
* @ref BT_AUDIO_BROADCAST_NAME_LEN_MIN and
1542+
* @ref BT_AUDIO_BROADCAST_NAME_LEN_MAX.
15341543
*
15351544
* @retval data_len The @p codec_cap.data_len on success
15361545
* @retval -EINVAL Arguments are invalid

‎subsys/bluetooth/audio/Kconfig.bap‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ config BT_BAP_UNICAST_SERVER
1616
depends on BT_ISO_PERIPHERAL
1717
depends on BT_ASCS
1818
depends on BT_BONDABLE
19+
depends on UTF8
1920
select BT_PAC_SRC if BT_ASCS_ASE_SNK
2021
select BT_PAC_SNK if BT_ASCS_ASE_SRC
2122
help
@@ -30,6 +31,7 @@ config BT_BAP_UNICAST_CLIENT
3031
depends on BT_CENTRAL
3132
depends on BT_ISO_CENTRAL
3233
depends on BT_BONDABLE
34+
depends on UTF8
3335
help
3436
This option enables support for Bluetooth Unicast Audio Client
3537
using Isochronous channels.
@@ -121,6 +123,7 @@ endif # BT_BAP_UNICAST_CLIENT
121123
config BT_BAP_BROADCAST_SOURCE
122124
bool "Bluetooth Broadcast Source Audio Support"
123125
depends on BT_ISO_BROADCASTER
126+
depends on UTF8
124127
help
125128
This option enables support for Bluetooth Broadcast Source Audio using
126129
Isochronous channels.
@@ -162,6 +165,7 @@ config BT_BAP_BROADCAST_SINK
162165
depends on BT_PAC_SNK
163166
depends on BT_PERIPHERAL
164167
depends on BT_BAP_SCAN_DELEGATOR
168+
depends on UTF8
165169
help
166170
This option enables support for Bluetooth Broadcast Sink Audio using
167171
Isochronous channels.

‎subsys/bluetooth/audio/codec.c‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
#include <stdint.h>
1717
#include <stdlib.h>
1818
#include <string.h>
19+
#include <sys/types.h>
1920

2021
#include <zephyr/autoconf.h>
2122
#include <zephyr/bluetooth/audio/audio.h>
@@ -1057,7 +1058,8 @@ static int codec_meta_get_broadcast_name(const uint8_t meta[], size_t meta_len,
10571058
}
10581059

10591060
ret = codec_meta_get_val(meta, meta_len, BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, &data);
1060-
if (data == NULL) {
1061+
if (data == NULL ||
1062+
!IN_RANGE(ret, BT_AUDIO_BROADCAST_NAME_LEN_MIN, BT_AUDIO_BROADCAST_NAME_LEN_MAX)) {
10611063
return -ENODATA;
10621064
}
10631065

@@ -1069,6 +1071,9 @@ static int codec_meta_get_broadcast_name(const uint8_t meta[], size_t meta_len,
10691071
static int codec_meta_set_broadcast_name(uint8_t meta[], size_t meta_len, size_t meta_size,
10701072
const uint8_t *broadcast_name, size_t broadcast_name_len)
10711073
{
1074+
char broadcast_name_str[BT_AUDIO_BROADCAST_NAME_LEN_MAX + sizeof('\0')];
1075+
ssize_t char_cnt;
1076+
10721077
CHECKIF(meta == NULL) {
10731078
LOG_DBG("meta is NULL");
10741079
return -EINVAL;
@@ -1079,6 +1084,21 @@ static int codec_meta_set_broadcast_name(uint8_t meta[], size_t meta_len, size_t
10791084
return -EINVAL;
10801085
}
10811086

1087+
if (!IN_RANGE(broadcast_name_len, BT_AUDIO_BROADCAST_NAME_LEN_MIN,
1088+
BT_AUDIO_BROADCAST_NAME_LEN_MAX)) {
1089+
LOG_DBG("Invalid broadcast name len %zu", broadcast_name_len);
1090+
return -EINVAL;
1091+
}
1092+
1093+
(void)memcpy(broadcast_name_str, broadcast_name, broadcast_name_len);
1094+
broadcast_name_str[broadcast_name_len] = '\0';
1095+
char_cnt = utf8_count_chars(broadcast_name_str);
1096+
if (!IN_RANGE(char_cnt, BT_AUDIO_BROADCAST_NAME_CHAR_MIN,
1097+
BT_AUDIO_BROADCAST_NAME_CHAR_MAX)) {
1098+
LOG_DBG("Invalid broadcast name %s", broadcast_name_str);
1099+
return -EINVAL;
1100+
}
1101+
10821102
return codec_meta_set_val(meta, meta_len, meta_size, BT_AUDIO_METADATA_TYPE_BROADCAST_NAME,
10831103
broadcast_name, broadcast_name_len);
10841104
}

‎tests/bluetooth/audio/codec/prj.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
CONFIG_ZTEST=y
2+
CONFIG_UTF8=y
23

34
CONFIG_BT=y
45
CONFIG_BT_SMP=y

‎tests/bluetooth/audio/codec/src/main.c‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -998,6 +998,66 @@ ZTEST(audio_codec_test_suite, test_bt_audio_codec_cfg_meta_set_broadcast_name)
998998
zassert_mem_equal(new_expected_data, broadcast_name, ARRAY_SIZE(new_expected_data));
999999
}
10001000

1001+
static ZTEST(audio_codec_test_suite, test_bt_audio_codec_cfg_meta_set_broadcast_name_inval_min_len)
1002+
{
1003+
const uint8_t new_data[] = {'n', 'e', 'w'};
1004+
struct bt_audio_codec_cfg codec_cfg =
1005+
BT_AUDIO_CODEC_CFG(BT_HCI_CODING_FORMAT_LC3, 0x0000, 0x0000, {},
1006+
{BT_AUDIO_CODEC_DATA(BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, 'm',
1007+
'y', ' ', 'b', 'c', 'a', 's', 't')});
1008+
int ret;
1009+
1010+
ret = bt_audio_codec_cfg_meta_set_broadcast_name(&codec_cfg, new_data,
1011+
ARRAY_SIZE(new_data));
1012+
zassert_equal(ret, -EINVAL, "Unexpected return value %d", ret);
1013+
}
1014+
1015+
static ZTEST(audio_codec_test_suite, test_bt_audio_codec_cfg_meta_set_broadcast_name_inval_max_len)
1016+
{
1017+
const uint8_t new_data[] = {'T', 'h', 'i', 's', ' ', 'i', 's', ' ', 'a', ' ', 'v',
1018+
'e', 'r', 'y', ' ', 'l', 'o', 'n', 'g', ' ', 's', 't',
1019+
'r', 'i', 'n', 'g', ' ', 't', 'o', ' ', 'r', 'e', 't',
1020+
'u', 'r', 'n', ' ', 'e', 'r', 'r', 'o', 'r'};
1021+
struct bt_audio_codec_cfg codec_cfg =
1022+
BT_AUDIO_CODEC_CFG(BT_HCI_CODING_FORMAT_LC3, 0x0000, 0x0000, {},
1023+
{BT_AUDIO_CODEC_DATA(BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, 'm',
1024+
'y', ' ', 'b', 'c', 'a', 's', 't')});
1025+
int ret;
1026+
1027+
ret = bt_audio_codec_cfg_meta_set_broadcast_name(&codec_cfg, new_data,
1028+
ARRAY_SIZE(new_data));
1029+
zassert_equal(ret, -EINVAL, "Unexpected return value %d", ret);
1030+
}
1031+
1032+
static ZTEST(audio_codec_test_suite, test_bt_audio_codec_cfg_meta_set_broadcast_name_inval_utf8)
1033+
{
1034+
const uint8_t new_data[] = {0x80, 0x80, 0x80, 0x80, 0x80};
1035+
struct bt_audio_codec_cfg codec_cfg =
1036+
BT_AUDIO_CODEC_CFG(BT_HCI_CODING_FORMAT_LC3, 0x0000, 0x0000, {},
1037+
{BT_AUDIO_CODEC_DATA(BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, 'm',
1038+
'y', ' ', 'b', 'c', 'a', 's', 't')});
1039+
int ret;
1040+
1041+
ret = bt_audio_codec_cfg_meta_set_broadcast_name(&codec_cfg, new_data,
1042+
ARRAY_SIZE(new_data));
1043+
zassert_equal(ret, -EINVAL, "Unexpected return value %d", ret);
1044+
}
1045+
1046+
static ZTEST(audio_codec_test_suite,
1047+
test_bt_audio_codec_cfg_meta_set_broadcast_name_inval_char_cnt_min)
1048+
{
1049+
const uint8_t new_data[] = "𠜎𠜎𠜎𠜎𠜎𠜎"; /* 2 4-octet characters */
1050+
struct bt_audio_codec_cfg codec_cfg =
1051+
BT_AUDIO_CODEC_CFG(BT_HCI_CODING_FORMAT_LC3, 0x0000, 0x0000, {},
1052+
{BT_AUDIO_CODEC_DATA(BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, 'm',
1053+
'y', ' ', 'b', 'c', 'a', 's', 't')});
1054+
int ret;
1055+
1056+
ret = bt_audio_codec_cfg_meta_set_broadcast_name(&codec_cfg, new_data,
1057+
ARRAY_SIZE(new_data));
1058+
zassert_equal(ret, -EINVAL, "Unexpected return value %d", ret);
1059+
}
1060+
10011061
ZTEST(audio_codec_test_suite, test_bt_audio_codec_cfg_meta_get_extended)
10021062
{
10031063
const uint8_t expected_data[] = {0x00, 0x01, 0x02, 0x03};
@@ -1950,6 +2010,37 @@ ZTEST(audio_codec_test_suite, test_bt_audio_codec_cap_meta_set_broadcast_name)
19502010
zassert_mem_equal(new_expected_data, broadcast_name, ARRAY_SIZE(new_expected_data));
19512011
}
19522012

2013+
static ZTEST(audio_codec_test_suite, test_bt_audio_codec_cap_meta_set_broadcast_name_inval_min_len)
2014+
{
2015+
const uint8_t new_data[] = {'n', 'e', 'w'};
2016+
struct bt_audio_codec_cap codec_cap =
2017+
BT_AUDIO_CODEC_CAP(BT_HCI_CODING_FORMAT_LC3, 0x0000, 0x0000, {},
2018+
{BT_AUDIO_CODEC_DATA(BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, 'm',
2019+
'y', ' ', 'b', 'c', 'a', 's', 't')});
2020+
int ret;
2021+
2022+
ret = bt_audio_codec_cap_meta_set_broadcast_name(&codec_cap, new_data,
2023+
ARRAY_SIZE(new_data));
2024+
zassert_equal(ret, -EINVAL, "Unexpected return value %d", ret);
2025+
}
2026+
2027+
static ZTEST(audio_codec_test_suite, test_bt_audio_codec_cap_meta_set_broadcast_name_inval_max_len)
2028+
{
2029+
const uint8_t new_data[] = {'T', 'h', 'i', 's', ' ', 'i', 's', ' ', 'a', ' ', 'v',
2030+
'e', 'r', 'y', ' ', 'l', 'o', 'n', 'g', ' ', 's', 't',
2031+
'r', 'i', 'n', 'g', ' ', 't', 'o', ' ', 'r', 'e', 't',
2032+
'u', 'r', 'n', ' ', 'e', 'r', 'r', 'o', 'r'};
2033+
struct bt_audio_codec_cap codec_cap =
2034+
BT_AUDIO_CODEC_CAP(BT_HCI_CODING_FORMAT_LC3, 0x0000, 0x0000, {},
2035+
{BT_AUDIO_CODEC_DATA(BT_AUDIO_METADATA_TYPE_BROADCAST_NAME, 'm',
2036+
'y', ' ', 'b', 'c', 'a', 's', 't')});
2037+
int ret;
2038+
2039+
ret = bt_audio_codec_cap_meta_set_broadcast_name(&codec_cap, new_data,
2040+
ARRAY_SIZE(new_data));
2041+
zassert_equal(ret, -EINVAL, "Unexpected return value %d", ret);
2042+
}
2043+
19532044
ZTEST(audio_codec_test_suite, test_bt_audio_codec_cap_meta_get_extended)
19542045
{
19552046
const uint8_t expected_data[] = {0x00, 0x01, 0x02, 0x03};

0 commit comments

Comments
 (0)