nRF5340 Audio application: NULL pointer dereference

Hi all,

I know that nRF5340 Audio application is still experimental and under development, but I noticed one thing that might be interesting for you. There are a couple of places in the code (even in the latest version in main branch on GitHub), where NULL pointer is dereferenced. Most notably in nrf5340_audio/src/bluetooth/le_audio_bis_headset.c in syncable_cb(). There's the following if statement:  

	if (active_stream.stream->ep->status.state == BT_AUDIO_EP_STATE_STREAMING ||
	    !playing_state) {
		LOG_DBG("Syncable received, but either in paused_state or already in a stream");
		return;
	}

The thing is, that at this point active_stream.stream->ep is NULL when syncable_cb gets called for the first time for a given sink. As a result status.state contains a random value. Most of the time this causes no harm, but if you would be extremely unlucky, than the random value could be equal to BT_AUDIO_EP_STATE_STREAMING which would lead to an early return from syncable_cb and thus to a loss of a syncable event. Also, if someone builds the application with CONFIG_NULL_POINTER_EXCEPTION_DETECTION_MPU=y, the application would crash here. 

Similar if statement suffering from the same issue is present in le_audio_volume_up/down/mute. 

Again, I know that this application is experimental, but I'm letting you know because this is exactly the type of a bug that might be difficult to hunt down. 

Also, since this is all on GitHub, is it ok for me as a person from outside to prepare a pull request fixing this issue? 

Thanks,

Lada 

Related