Linux bluetooth development
 help / color / mirror / Atom feed
* [BlueZ 1/3] avrcp: Split off name parsing from parse_*_element()
@ 2026-08-04 12:44 Bastien Nocera
  2026-08-04 12:44 ` [BlueZ 2/3] unit: Adapt poc_*_oob.c test into a new test Bastien Nocera
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Bastien Nocera @ 2026-08-04 12:44 UTC (permalink / raw)
  To: linux-bluetooth

This will allow us to use the name extraction code in
parse_media_element() and parse_folder_element() separately, such
as in tests.
---
 Makefile.plugins             |  1 +
 profiles/audio/avrcp-parse.c | 47 ++++++++++++++++++++++++++++++++++++
 profiles/audio/avrcp-parse.h | 18 ++++++++++++++
 profiles/audio/avrcp.c       | 26 +++++---------------
 4 files changed, 72 insertions(+), 20 deletions(-)
 create mode 100644 profiles/audio/avrcp-parse.c
 create mode 100644 profiles/audio/avrcp-parse.h

diff --git a/Makefile.plugins b/Makefile.plugins
index ac667beda847..a505fcd6691f 100644
--- a/Makefile.plugins
+++ b/Makefile.plugins
@@ -37,6 +37,7 @@ builtin_modules += avrcp
 builtin_sources += profiles/audio/control.h profiles/audio/control.c \
 			profiles/audio/avctp.h profiles/audio/avctp.c \
 			profiles/audio/avrcp.h profiles/audio/avrcp.c \
+			profiles/audio/avrcp-parse.h profiles/audio/avrcp-parse.c \
 			profiles/audio/avrcp-player.c
 endif
 
diff --git a/profiles/audio/avrcp-parse.c b/profiles/audio/avrcp-parse.c
new file mode 100644
index 000000000000..d3d0a070a4da
--- /dev/null
+++ b/profiles/audio/avrcp-parse.c
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2026  Red Hat Inc.
+ *
+ *
+ */
+
+#include "avrcp-parse.h"
+#include "src/shared/util.h"
+
+gboolean parse_media_element_name(uint8_t *operands, uint16_t len,
+					 char *name, uint16_t *namesize)
+{
+	uint16_t namelen;
+
+	if (len < 13)
+		return FALSE;
+
+	memset(name, 0, NAME_MAX_LEN);
+	*namesize = get_be16(&operands[11]);
+	namelen = MIN(*namesize, NAME_MAX_LEN - 1);
+	if (namelen > 0) {
+		memcpy(name, &operands[13], namelen);
+		strtoutf8(name, namelen);
+	}
+
+	return TRUE;
+}
+
+gboolean parse_media_folder_name(uint8_t *operands, uint16_t len,
+					char *name)
+{
+	uint16_t namelen;
+
+	if (len < 12)
+		return FALSE;
+
+	memset(name, 0, NAME_MAX_LEN);
+	namelen = MIN(get_be16(&operands[12]), NAME_MAX_LEN - 1);
+	if (namelen > 0)
+		memcpy(name, &operands[14], namelen);
+
+	return TRUE;
+}
diff --git a/profiles/audio/avrcp-parse.h b/profiles/audio/avrcp-parse.h
new file mode 100644
index 000000000000..d98aab4b2eee
--- /dev/null
+++ b/profiles/audio/avrcp-parse.h
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2026  Red Hat Inc.
+ *
+ *
+ */
+
+#include <glib.h>
+
+#define NAME_MAX_LEN 255
+
+gboolean parse_media_element_name(uint8_t *operands, uint16_t len,
+					 char *name, uint16_t *namesize);
+gboolean parse_media_folder_name(uint8_t *operands, uint16_t len,
+					char *name);
diff --git a/profiles/audio/avrcp.c b/profiles/audio/avrcp.c
index 2194a913580f..af3c72174764 100644
--- a/profiles/audio/avrcp.c
+++ b/profiles/audio/avrcp.c
@@ -52,6 +52,7 @@
 
 #include "avctp.h"
 #include "avrcp.h"
+#include "avrcp-parse.h"
 #include "control.h"
 #include "media.h"
 #include "player.h"
@@ -2614,24 +2615,15 @@ static struct media_item *parse_media_element(struct avrcp *session,
 	struct avrcp_player *player;
 	struct media_player *mp;
 	struct media_item *item;
-	uint16_t namelen, namesize;
-	char name[255];
+	uint16_t namesize;
+	char name[NAME_MAX_LEN];
 	uint64_t uid;
 	uint8_t count;
 
-	if (len < 13)
+	if (!parse_media_element_name(operands, len, name, &namesize))
 		return NULL;
 
 	uid = get_be64(&operands[0]);
-
-	memset(name, 0, sizeof(name));
-	namesize = get_be16(&operands[11]);
-	namelen = MIN(namesize, sizeof(name) - 1);
-	if (namelen > 0) {
-		memcpy(name, &operands[13], namelen);
-		strtoutf8(name, namelen);
-	}
-
 	count = operands[13 + namesize];
 
 	player = session->controller->player;
@@ -2655,24 +2647,18 @@ static struct media_item *parse_media_folder(struct avrcp *session,
 	struct avrcp_player *player = session->controller->player;
 	struct media_player *mp = player->user_data;
 	struct media_item *item;
-	uint16_t namelen;
-	char name[255];
+	char name[NAME_MAX_LEN];
 	uint64_t uid;
 	uint8_t type;
 	uint8_t playable;
 
-	if (len < 12)
+	if (!parse_media_folder_name(operands, len, name))
 		return NULL;
 
 	uid = get_be64(&operands[0]);
 	type = operands[8];
 	playable = operands[9];
 
-	memset(name, 0, sizeof(name));
-	namelen = MIN(get_be16(&operands[12]), sizeof(name) - 1);
-	if (namelen > 0)
-		memcpy(name, &operands[14], namelen);
-
 	item = media_player_create_folder(mp, name, type, uid);
 	if (!item)
 		return NULL;
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-04 13:49 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-04 12:44 [BlueZ 1/3] avrcp: Split off name parsing from parse_*_element() Bastien Nocera
2026-08-04 12:44 ` [BlueZ 2/3] unit: Adapt poc_*_oob.c test into a new test Bastien Nocera
2026-08-04 12:44 ` [BlueZ 3/3] avrcp: Fix Out-of-Bounds Read in AVRCP GetFolderItems parsing Bastien Nocera
2026-08-04 13:49 ` [BlueZ,1/3] avrcp: Split off name parsing from parse_*_element() bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox