nimble/audio/bass: Modify add source operation in BASS

Fix memcpy wrong field format from address.
Move check_bis_sync up, so add source can use it.
Add checks for address type.
Add checks for advertising sid.
Add pa_sync_state and num of subgroups to receive state.

nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h

@@ -71,6 +71,9 @@
 /** BLE AUDIO BASS Error: Invalid Source ID */
 #define BLE_SVC_AUDIO_BASS_ERR_INVALID_SOURCE_ID 0x81
 
+/** BLE AUDIO BASS ADVERTISING SID MAX VALUE */
+#define BLE_SVC_AUDIO_BASS_ADV_SID_MAX_VAL 0x0F
+
 /** BLE AUDIO BASS Encryption States */
 enum ble_svc_audio_bass_big_enc {
  /** BLE AUDIO BASS BIG Encryption: Not Encrypted */

nimble/host/audio/services/bass/src/ble_audio_svc_bass.c

@@ -282,6 +282,28 @@ ble_svc_audio_bass_remote_scan_started(uint8_t *data, uint16_t data_len, uint16_
  return 0;
 }
 
+static int
+check_bis_sync(uint16_t num_subgroups, const uint32_t *bis_sync_list)
+{
+ uint32_t bis_sync_mask = 0;
+ int i;
+ int j;
+
+ for (i = 0; i < num_subgroups; i++) {
+ if (bis_sync_list[i] != 0xFFFFFFFF) {
+ for (j = 0; j < num_subgroups; j++) {
+ if (bis_sync_list[i] & bis_sync_mask) {
+ return BLE_HS_EINVAL;
+ }
+
+ bis_sync_mask |= bis_sync_list[i];
+ }
+ }
+ }
+
+ return 0;
+}
+
 static int
 ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_handle)
 {
@@ -307,9 +329,21 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
  operation.conn_handle = conn_handle;
 
  operation.add_source.adv_addr.type = data[offset++];
+ if (operation.add_source.adv_addr.type != BLE_ADDR_PUBLIC ||
+ operation.add_source.adv_addr.type != BLE_ADDR_RANDOM) {
+ rc = BLE_HS_EINVAL;
+ ev.bass_operation_status.status = BLE_HS_EINVAL;
+ goto done;
+ }
  memcpy(operation.add_source.adv_addr.val, &data[offset], 6);
  offset += 6;
  operation.add_source.adv_sid = data[offset++];
+ if (operation.add_source.adv_sid > BLE_SVC_AUDIO_BASS_ADV_SID_MAX_VAL) {
+ rc = BLE_HS_EINVAL;
+ ev.bass_operation_status.status = BLE_HS_EINVAL;
+ goto done;
+ }
+
  operation.add_source.broadcast_id = get_le24(&data[offset]);
  offset += 3;
  operation.add_source.pa_sync = data[offset++];
@@ -346,6 +380,13 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
  operation.add_source.subgroups[i].metadata = &data[offset];
  offset += operation.add_source.subgroups[i].metadata_length;
  data_len -= operation.add_source.subgroups[i].metadata_length;
+
+ if (check_bis_sync(operation.add_source.num_subgroups,
+ operation.add_source.bis_sync)) {
+ rc = BLE_HS_EINVAL;
+ ev.bass_operation_status.status = BLE_HS_EREJECT;
+ goto done;
+ }
  }
 
  source_id_new = ble_svc_audio_bass_get_new_source_id();
@@ -393,9 +434,10 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
 
  ev.bass_operation_status.source_id = rcv_state->source_id;
  rcv_state->state.source_addr.type = operation.add_source.adv_addr.type;
- memcpy(&rcv_state->state.source_addr.type, operation.add_source.adv_addr.val, 6);
+ memcpy(&rcv_state->state.source_addr.val, operation.add_source.adv_addr.val, 6);
  rcv_state->state.source_adv_sid = operation.add_source.adv_sid;
  rcv_state->state.broadcast_id = operation.add_source.broadcast_id;
+ rcv_state->state.num_subgroups = operation.add_source.num_subgroups;
 
  for (i = 0; i < operation.add_source.num_subgroups; i++) {
  metadata_ptr = os_memblock_get(&ble_audio_svc_bass_metadata_pool);
@@ -423,28 +465,6 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
  return rc;
 }
 
-static int
-check_bis_sync(uint16_t num_subgroups, const uint32_t *bis_sync_list)
-{
- uint32_t bis_sync_mask = 0;
- int i;
- int j;
-
- for (i = 0; i < num_subgroups; i++) {
- if (bis_sync_list[i] != 0xFFFFFFFF) {
- for (j = 0; j < num_subgroups; j++) {
- if (bis_sync_list[i] & bis_sync_mask) {
- return BLE_HS_EINVAL;
- }
-
- bis_sync_mask |= bis_sync_list[i];
- }
- }
- }
-
- return 0;
-}
-
 static int
 ble_svc_audio_bass_modify_source(uint8_t *data, uint16_t data_len, uint16_t conn_handle)
 {