[PATCH BlueZ v2 1/8] shared/gatt: Validate Read By Type responses

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

read_by_type_cb used the peer-provided Attribute Data Length without
validation, causing a division by zero when it was 0 and out-of-bounds
reads when it was shorter than a handle or the PDU itself. Reject such
responses as the other discovery handlers do.

Also check the iterator result and value length before reading the
Server Features value.

Closes: https://github.com/bluez/bluez/issues/2746
Fixes: d21412b96048 ("shared/gatt: Implement "Characteristic Discovery" procedures.")
Fixes: 76d63c91b27a ("shared/gatt-client: Add support for EATT features")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c  | 6 ++++--
 src/shared/gatt-helpers.c | 7 ++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 836a59a8c990..09bd9c971ee5 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1565,8 +1565,10 @@ static void db_server_feat_read(bool success, uint8_t att_ecode,
 	if (!result)
 		return;
 
-	bt_gatt_iter_init(&iter, result);
-	bt_gatt_iter_next_read_by_type(&iter, &handle, &len, &value);
+	if (!bt_gatt_iter_init(&iter, result) ||
+			!bt_gatt_iter_next_read_by_type(&iter, &handle,
+						&len, &value) || !len)
+		return;
 
 	DBG(client, "Server Features found: handle 0x%04x "
 				"length 0x%04x value 0x%02x", handle, len,
diff --git a/src/shared/gatt-helpers.c b/src/shared/gatt-helpers.c
index b3d5d8f1a483..e3281ec17758 100644
--- a/src/shared/gatt-helpers.c
+++ b/src/shared/gatt-helpers.c
@@ -1299,14 +1299,15 @@ static void read_by_type_cb(uint8_t opcode, const void *pdu,
 		goto done;
 	}
 
-	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu) {
+	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu || length < 3) {
 		success = false;
 		att_ecode = 0;
 		goto done;
 	}
 
-	data_length = ((uint8_t *) pdu)[0];
-	if (((length - 1) % data_length)) {
+	data_length = ((const uint8_t *) pdu)[0];
+	if (data_length < 2 || data_length > length - 1U ||
+					(length - 1) % data_length) {
 		success = false;
 		att_ecode = 0;
 		goto done;
-- 
2.56.0