Skip to content

Bluetooth: CAP: Broadcast: Add check for memory allocation for create #89034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

Thalley
Copy link
Collaborator

@Thalley Thalley commented Apr 24, 2025

When creating a broadcast source with
bt_cap_initiator_broadcast_audio_create there was no check if all broadcast sources were already allocated, which could cause a NULL pointer dereference.

Add a check, a test and documentation about possibly error codes of the function.

When creating a broadcast source with
bt_cap_initiator_broadcast_audio_create there was no check if
all broadcast sources were already allocated, which could cause
a NULL pointer dereference.

Add a check, a test and documentation about possibly
error codes of the function.

Signed-off-by: Emil Gydesen <[email protected]>
@Thalley Thalley requested a review from Copilot April 24, 2025 12:58
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a check in the broadcast source creation path to prevent a NULL pointer dereference when all broadcast sources are already allocated. It includes new error handling in the CAP initiator, updates to the test to verify the failure case when too many sources are allocated, and enhanced documentation in the header for the error codes that may be returned.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
tests/bsim/bluetooth/audio/src/cap_initiator_broadcast_test.c Updates the test to use an array of broadcast source pointers and verifies that creating more than the allowable sources returns -ENOMEM.
subsys/bluetooth/audio/cap_initiator.c Initializes the output pointer, iterates properly over available sources, and returns appropriate error codes based on the error from the lower-level create call.
include/zephyr/bluetooth/audio/cap.h Enhances the API documentation with detailed error codes for failure scenarios.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: In Review
Development

Successfully merging this pull request may close these issues.

1 participant