[PATCH BlueZ v2 3/8] shared/gatt-client: Fix handling of short notifications

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A Handle Value Notification or Indication shorter than a handle made
notify_cb read the handle past the PDU and wrap the value length to
65534, passing a value larger than the received buffer to the
registered handlers. Ignore such PDUs.

Fixes: 151582e6a343 ("shared/gatt-client: Handle incoming not/ind PDUs.")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 09bd9c971ee5..2b6da611b9f1 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2299,6 +2299,9 @@ static void notify_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 			pdu += data.len;
 		}
 	} else {
+		if (length < 2)
+			goto done;
+
 		data.handle = get_le16(pdu);
 		length -= 2;
 		pdu += 2;
-- 
2.56.0