nimble/audio/bass: Modify add source operation in BASS

Modify add source with new mbuf data style format.
Add BIS sync information to receive state.
Fix memcpy wrong field format from address.
Move check_bis_sync up, so add source can use it.
Add checks for address type.
Add checks for advertising sid.
Add pa_sync_state and num of subgroups to receive state.

nimble/host/audio/services/bass/include/services/bass/ble_audio_svc_bass.h

@@ -71,6 +71,9 @@
 /** BLE AUDIO BASS Error: Invalid Source ID */
 #define BLE_SVC_AUDIO_BASS_ERR_INVALID_SOURCE_ID                         0x81
 
+/** BLE AUDIO BASS ADVERTISING SID MAX VALUE */
+#define BLE_SVC_AUDIO_BASS_ADV_SID_MAX_VAL                               0x0F
+
 /** BLE AUDIO BASS Encryption States */
 enum ble_svc_audio_bass_big_enc {
     /** BLE AUDIO BASS BIG Encryption: Not Encrypted */

nimble/host/audio/services/bass/src/ble_audio_svc_bass.c

@@ -274,6 +274,28 @@ ble_svc_audio_bass_remote_scan_started(uint8_t *data, uint16_t data_len, uint16_
     return 0;
 }
 
+static int
+check_bis_sync(uint16_t num_subgroups, const uint32_t *bis_sync_list)
+{
+    uint32_t bis_sync_mask = 0;
+    int i;
+    int j;
+
+    for (i = 0; i < num_subgroups; i++) {
+        if (bis_sync_list[i] != 0xFFFFFFFF) {
+            for (j = 0; j < num_subgroups; j++) {
+                if (bis_sync_list[i] & bis_sync_mask) {
+                    return BLE_HS_EINVAL;
+                }
+
+                bis_sync_mask |= bis_sync_list[i];
+            }
+        }
+    }
+
+    return 0;
+}
+
 static int
 ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_handle)
 {
@@ -299,9 +321,21 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
     operation.conn_handle = conn_handle;
 
     operation.add_source.adv_addr.type = data[offset++];
+    if (operation.add_source.adv_addr.type != BLE_ADDR_PUBLIC ||
+        operation.add_source.adv_addr.type != BLE_ADDR_RANDOM) {
+        rc = BLE_HS_EINVAL;
+        ev.bass_operation_status.status = BLE_HS_EINVAL;
+        goto done;
+    }
     memcpy(operation.add_source.adv_addr.val, &data[offset], 6);
     offset += 6;
     operation.add_source.adv_sid = data[offset++];
+    if (operation.add_source.adv_sid > BLE_SVC_AUDIO_BASS_ADV_SID_MAX_VAL) {
+        rc = BLE_HS_EINVAL;
+        ev.bass_operation_status.status = BLE_HS_EINVAL;
+        goto done;
+    }
+
     operation.add_source.broadcast_id = get_le24(&data[offset]);
     offset += 3;
     operation.add_source.pa_sync = data[offset++];
@@ -338,6 +372,19 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
         operation.add_source.subgroups[i].metadata = &data[offset];
         offset += operation.add_source.subgroups[i].metadata_length;
         data_len -= operation.add_source.subgroups[i].metadata_length;
+
+        if (check_bis_sync(operation.add_source.num_subgroups,
+                           operation.add_source.bis_sync)) {
+            rc = BLE_HS_EINVAL;
+            ev.bass_operation_status.status = BLE_HS_EREJECT;
+            goto done;
+        }
+
+        if (data_len != 0) {
+            rc = BLE_ATT_ERR_WRITE_REQ_REJECTED;
+            ev.bass_operation_status.status = BLE_HS_EREJECT;
+            goto done;
+        }
     }
 
     source_id_new = ble_svc_audio_bass_get_new_source_id();
@@ -385,9 +432,11 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
 
     ev.bass_operation_status.source_id = rcv_state->source_id;
     rcv_state->state.source_addr.type = operation.add_source.adv_addr.type;
-    memcpy(&rcv_state->state.source_addr.type, operation.add_source.adv_addr.val, 6);
+    memcpy(&rcv_state->state.source_addr.val, operation.add_source.adv_addr.val, 6);
     rcv_state->state.source_adv_sid = operation.add_source.adv_sid;
     rcv_state->state.broadcast_id = operation.add_source.broadcast_id;
+    rcv_state->state.pa_sync_state = operation.add_source.pa_sync;
+    rcv_state->state.num_subgroups = operation.add_source.num_subgroups;
 
     for (i = 0; i < operation.add_source.num_subgroups; i++) {
         metadata_ptr = os_memblock_get(&ble_audio_svc_bass_metadata_pool);
@@ -415,28 +464,6 @@ ble_svc_audio_bass_add_source(uint8_t *data, uint16_t data_len, uint16_t conn_ha
     return rc;
 }
 
-static int
-check_bis_sync(uint16_t num_subgroups, const uint32_t *bis_sync_list)
-{
-    uint32_t bis_sync_mask = 0;
-    int i;
-    int j;
-
-    for (i = 0; i < num_subgroups; i++) {
-        if (bis_sync_list[i] != 0xFFFFFFFF) {
-            for (j = 0; j < num_subgroups; j++) {
-                if (bis_sync_list[i] & bis_sync_mask) {
-                    return BLE_HS_EINVAL;
-                }
-
-                bis_sync_mask |= bis_sync_list[i];
-            }
-        }
-    }
-
-    return 0;
-}
-
 static int
 ble_svc_audio_bass_modify_source(uint8_t *data, uint16_t data_len, uint16_t conn_handle)
 {