Skip to content

nimble/audio: Bound broadcast sink subgroup count#2251

Open
Old-Ding wants to merge 2 commits into
apache:masterfrom
Old-Ding:fix/broadcast-sink-subgroups-bound
Open

nimble/audio: Bound broadcast sink subgroup count#2251
Old-Ding wants to merge 2 commits into
apache:masterfrom
Old-Ding:fix/broadcast-sink-subgroups-bound

Conversation

@Old-Ding

@Old-Ding Old-Ding commented Jul 1, 2026

Copy link
Copy Markdown

Summary

  • reject broadcast sink sync options whose subgroup count exceeds capacity
  • add a broadcast sink unit test for oversized subgroup counts
  • enable broadcast sink coverage in the audio unit test syscfg
  • enable the periodic advertising sync transfer and BIGINFO report syscfg options needed by the broadcast sink GAP event handler

Root cause

ble_audio_broadcast_sink_config() copied sync_opt->num_subgroups
into sink->num_subgroups and then used it as the loop bound for the
fixed sink->subgroups[] array. The visible guard was only a debug
assertion in the scan delegator path, so production builds could still
receive an oversized sync option.

Enabling BLE_AUDIO_BROADCAST_SINK in the audio unit test also compiles
ble_audio_broadcast_sink.c, whose GAP handler references periodic sync
transfer and BIGINFO report event fields. The test syscfg now enables the
feature flags that expose those fields and declarations.

Validation

  • git diff --check
  • newt test @apache-mynewt-nimble/nimble/host/audio/test -j 4 parses the package and updated syscfg on this Windows host, then stops at the native compiler step because gcc is unavailable locally.
  • PR-target checks are passing. Heavy pull_request workflows for head e93fbb98e6eec1e69680067a7dcba30f28fb9e31 are action_required with no jobs, so the PR is waiting for maintainer workflow approval before those CI jobs can rerun.

Fixes #2188.

@github-actions github-actions Bot added host size/S Small PR labels Jul 1, 2026
@Old-Ding Old-Ding force-pushed the fix/broadcast-sink-subgroups-bound branch from e23bad0 to 577a451 Compare July 1, 2026 02:23
@Old-Ding Old-Ding changed the title [codex] nimble/audio: Bound broadcast sink subgroup count nimble/audio: Bound broadcast sink subgroup count Jul 1, 2026
@Old-Ding Old-Ding marked this pull request as ready for review July 1, 2026 02:49
@sjanc

sjanc commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Hi,

I have mixed feelings on this PR, while fix itself seems to be OK from quick look, unittest is not building, and if it would build it would fail (due to #2254).

So, was this tested at all?

Reject sync requests whose subgroup count exceeds the broadcast
sink subgroup array before copying BIS sync values into it.

The previous code relied on a debug assertion in the scan
delegator path, but production builds can still receive an
oversized sync option.

Fixes apache#2188

Signed-off-by: Old-Ding <ai.neo.ae86@gmail.com>
@Old-Ding Old-Ding force-pushed the fix/broadcast-sink-subgroups-bound branch from 577a451 to a1471dd Compare July 8, 2026 03:25
The audio unit test now builds the broadcast sink, whose GAP handler uses PAST and BIGInfo report fields and calls ble_gap_periodic_adv_sync_receive(). Enable those periodic advertising features in the test syscfg so the corresponding host declarations are visible.

Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug] ble_audio_broadcast_sink configuration does not bound num_subgroups before writing sink->subgroups

3 participants