patrick/zephyr
1
0
Fork 0
Code Issues Pull requests Actions 7 Packages Projects Releases Wiki Activity

Bluetooth: audio: pacs: Fix invalid lookup

Browse source 
This fixes client lookup that was done with use of bt_conn_index while
the size of the client array is CONFIG_BT_MAX_PAIRED.

Signed-off-by: Mariusz Skamra <mariusz.skamra@codecoup.pl>
This commit is contained in:
Mariusz Skamra 2023-12-01 14:44:26 +01:00 committed by Fabio Baltieri
parent ef362e766a
commit 014c22c9c0
1 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
subsys/bluetooth/audio/pacs.c
View file

@ -93,6 +93,20 @@ struct pac_records_build_data {
struct net_buf_simple *buf;
};
static struct pacs_client *client_lookup_conn(const struct bt_conn *conn)
{
__ASSERT_NO_MSG(conn != NULL);
for (size_t i = 0; i < ARRAY_SIZE(clients); i++) {
if (atomic_test_bit(clients[i].flags, FLAG_ACTIVE) &&
bt_addr_le_eq(&clients[i].addr, bt_conn_get_dst(conn))) {
return &clients[i];
}
}
return NULL;
}
static void pacs_set_notify_bit(int bit)
{
for (size_t i = 0U; i < ARRAY_SIZE(clients); i++) {
@ -789,7 +803,7 @@ static int pacs_gatt_notify(struct bt_conn *conn,
static void notify_cb(struct bt_conn *conn, void *data)
{
struct pacs_client *client = &clients[bt_conn_index(conn)];
struct pacs_client *client;
struct bt_conn_info info;
int err = 0;
@ -806,6 +820,11 @@ static void notify_cb(struct bt_conn *conn, void *data)
return;
}
client = client_lookup_conn(conn);
if (client == NULL) {
return;
}
/* Check if we have unverified notifications in progress */
if (atomic_get(&notify_rdy)) {
return;