[PATCH BlueZ v2 0/8] Fix handling of malformed GATT PDUs

[PATCH BlueZ v2 0/8] Fix handling of malformed GATT PDUs

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes several places where GATT PDUs received from the peer are
used without proper validation:

 - Read By Type responses with an invalid Attribute Data Length could
   cause a division by zero and out-of-bounds reads during discovery.
 - Notifications and indications shorter than a handle wrapped the
   value length to 65534, passing data past the received buffer to the
   registered handlers.
 - Read Multiple Variable Length opcodes were missing from the ATT
   tables, so the server never responded to the request, and the
   client response parser did not advance past each value.
 - Database Hash and Extended Properties values were read without
   checking their length.

The Read By Type, notification and Read Multiple Variable Length fixes
come with unit tests reproducing the problem.

v2:
 - Fix use-after-free when a callback cancels a Read Multiple Variable
   Length request while its values are being dispatched, and add a test
   for it.

Luiz Augusto von Dentz (8):
  shared/gatt: Validate Read By Type responses
  unit/test-gatt: Add malformed Read By Type response tests
  shared/gatt-client: Fix handling of short notifications
  unit/test-gatt: Add short notification test
  shared/att: Add Read Multiple Variable Length opcodes
  shared/gatt-client: Fix parsing Read Multiple Variable Length response
  shared/gatt-client: Check value lengths before reading them
  unit/test-gatt: Add Read Multiple Variable Length tests

 src/shared/att.c          |   3 +
 src/shared/gatt-client.c  |  30 +++-
 src/shared/gatt-helpers.c |   7 +-
 unit/test-gatt.c          | 307 +++++++++++++++++++++++++++++++++++++-
 4 files changed, 333 insertions(+), 14 deletions(-)

-- 
2.56.0

[PATCH BlueZ v2 1/8] shared/gatt: Validate Read By Type responses

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

read_by_type_cb used the peer-provided Attribute Data Length without
validation, causing a division by zero when it was 0 and out-of-bounds
reads when it was shorter than a handle or the PDU itself. Reject such
responses as the other discovery handlers do.

Also check the iterator result and value length before reading the
Server Features value.

Closes: https://github.com/bluez/bluez/issues/2746
Fixes: d21412b96048 ("shared/gatt: Implement "Characteristic Discovery" procedures.")
Fixes: 76d63c91b27a ("shared/gatt-client: Add support for EATT features")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c  | 6 ++++--
 src/shared/gatt-helpers.c | 7 ++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 836a59a8c990..09bd9c971ee5 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -1565,8 +1565,10 @@ static void db_server_feat_read(bool success, uint8_t att_ecode,
 	if (!result)
 		return;
 
-	bt_gatt_iter_init(&iter, result);
-	bt_gatt_iter_next_read_by_type(&iter, &handle, &len, &value);
+	if (!bt_gatt_iter_init(&iter, result) ||
+			!bt_gatt_iter_next_read_by_type(&iter, &handle,
+						&len, &value) || !len)
+		return;
 
 	DBG(client, "Server Features found: handle 0x%04x "
 				"length 0x%04x value 0x%02x", handle, len,
diff --git a/src/shared/gatt-helpers.c b/src/shared/gatt-helpers.c
index b3d5d8f1a483..e3281ec17758 100644
--- a/src/shared/gatt-helpers.c
+++ b/src/shared/gatt-helpers.c
@@ -1299,14 +1299,15 @@ static void read_by_type_cb(uint8_t opcode, const void *pdu,
 		goto done;
 	}
 
-	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu) {
+	if (opcode != BT_ATT_OP_READ_BY_TYPE_RSP || !pdu || length < 3) {
 		success = false;
 		att_ecode = 0;
 		goto done;
 	}
 
-	data_length = ((uint8_t *) pdu)[0];
-	if (((length - 1) % data_length)) {
+	data_length = ((const uint8_t *) pdu)[0];
+	if (data_length < 2 || data_length > length - 1U ||
+					(length - 1) % data_length) {
 		success = false;
 		att_ecode = 0;
 		goto done;
-- 
2.56.0

RE: Fix handling of malformed GATT PDUs

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 56478 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1204442/

---Test result---

Test Summary:
CheckPatch                    PASS      4.11 seconds
GitLint                       FAIL      2.62 seconds
BuildEll                      PASS      20.40 seconds
BluezMake                     PASS      306.18 seconds
MakeCheck                     PASS      14.57 seconds
MakeDistcheck                 PASS      144.97 seconds
CheckValgrind                 PASS      343.73 seconds
CheckSmatch                   WARNING   300.94 seconds
bluezmakeextell               PASS      98.86 seconds
TestFunctional                FAIL      1279.72 seconds
IncrementalBuild              PASS      455.45 seconds
ScanBuild                     PASS      1165.77 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[BlueZ,v2,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

1: T1 Title exceeds max length (85>80): "[BlueZ,v2,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response"
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.src/shared/gatt-helpers.c:764:31: warning: Variable length array is used.src/shared/gatt-helpers.c:842:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1336:31: warning: Variable length array is used.src/shared/gatt-helpers.c:1367:23: warning: Variable length array is used.
##############################
Test: TestFunctional - FAIL
Desc: Run test-functional
Output:
FAIL functional.test_bearer::test_bearer_le_conn_update[hosts14-vm2]: failed on teardown with "pytest_bluezenv.plugin.CoredumpWarning: Core dump: test-bluezenv-hosts14.1-bluetoothd-1794005149-189.core
        /usr/bin/gdb: warning: Couldn't determine a path for the index cache directory.
        [New LWP 189]
        [Thread debugging using libthread_db enabled]
        Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
        Core was generated by `/home/runner/work/bluez/bluez/src/src/src/bluetoothd --nodetach -f /run/bluetoo'.
        Program terminated with signal SIGABRT, Aborted.
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44

        warning: 44	./nptl/pthread_kill.c: No such file or directory

        Thread 1 (Thread 0x7feab89bb900 (LWP 189)):
        #0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
                tid = <optimized out>
                ret = 0
                pd = <optimized out>
                old_mask = {__val = {4412750543122677053}}
                ret = <optimized out>
        #1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
        No locals.
        #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
        No locals.
        #3  0x00007feab9116b7e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
                ret = <optimized out>
        #4  0x00007feab90f98ec in __GI_abort () at ./stdlib/abort.c:77
                act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 0, 0, 0, 0, 140729938411056, 22, 140646100904912, 0, 140729938410992, 140646117750294, 140646090289152, 4096, 0, 17847858331768781312, 140646091194392}}, sa_flags = -1169940480, sa_restorer = 0x16}
        #5  0x00007feab9d21a0f in __sanitizer::Abort () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:165
        No locals.
        #6  0x00007feab9e47c2d in __sanitizer::Die () at ../../../../src/libsanitizer/sanitizer_common/sanitizer_termination.cpp:58
        No locals.
        #7  0x00007feab9e1c93c in __asan::ScopedInErrorReport::~ScopedInErrorReport (this=0x7ffe3dfcff66) at ../../../../src/libsanitizer/asan/asan_report.cpp:221
                buffer_copy = {buffer_ = {<__sanitizer::InternalMmapVectorNoCtor<char, false>> = {data_ = 0x7beab2c85000 '=' <repeats 65 times>, "\n==189==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cfab7ee1720 at pc 0x5556795d3bad bp 0x7ffe3dfd0be0 sp 0x7ffe3dfd0bd0"..., capacity_bytes_ = 8192, size_ = 4282}, <No data fields>}}
                buffer_copy = <optimized out>
                l = <optimized out>
        #8  0x00007feab9e1be02 in __asan::ReportGenericError (pc=93829891701677, bp=140729938414560, sp=sp@entry=140729938414544, addr=137416269502240, is_write=is_write@entry=false, access_size=8, fatal=true, exp=<optimized out>) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = {error_report_lock_ = {<No data fields>}, static current_error_ = {kind = __asan::kErrorKindGeneric, {Base = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, DeadlySignal = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, signal = {siginfo = 0xf7b0549700000002, context = 0x7cfab7ee1720, addr = 0, pc = 0, sp = 6137508266440, bp = 137416269502240, is_memory_access = 96, write_flag = __sanitizer::SignalContext::Unknown, is_true_faulting_addr = 192}}, DoubleFree = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, second_free_stack = 0xf7b0549700000002, addr_description = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}}, NewDeleteTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0xf7b0549700000002, addr_description = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, delete_size = 140646088202608, delete_alignment = 140729938412656}, FreeNotMalloced = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, free_stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}}, AllocTypeMismatch = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, dealloc_stack = 0xf7b0549700000002, alloc_type = 3085834016, dealloc_type = 31994, addr_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 0, kind = (unknown: 0xc8), shadow_byte = 1 '\001'}, heap = {addr = 0, alloc_tid = 6137508266440, free_tid = 137416269502240, alloc_stack_id = 96, free_stack_id = 0, chunk_access = {bad_addr = 137416269502144, offset = 232, chunk_begin = 140728898445320, chunk_size = 140646088202608, user_requested_alignment = 1136, access_type = 0, alloc_type = 0}}, stack = {addr = 0, tid = 6137508266440, offset = 137416269502240, frame_pc = 96, access_size = 137416269502144, frame_descr = 0xe8 <error: Cannot access memory at address 0xe8>}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 6137508266440, size = 137416269502240, size_with_redzone = 96, name = 0x7cfab7ee16c0 "\225\005", module_name = 0xe8 <error: Cannot access memory at address 0xe8>, has_dynamic_init = 140728898445320, gcc_location = 0x7feab8205970, odr_indicator = 140729938412656}, {beg = 2, size = 140646118318016, size_with_redzone = 137210111069072, name = 0x7ffe3dfd0440 "\220\f\375=\376\177", module_name = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", has_dynamic_init = 160, gcc_location = 0x7ccab7ee0b90, odr_indicator = 140646092394704}, {beg = 140729938412640, size = 137210111069088, size_with_redzone = 93829890737488, name = 0x7ffe3dfd0d70 "", module_name = 0x7beab6bdd220 "pU\356\267Z|", has_dynamic_init = 140729938414736, gcc_location = 0x7feab9e0e3c1 <___interceptor_free(void*)+113>, odr_indicator = 140729938412640}, {beg = 131955619458, size = 140729938412656, size_with_redzone = 2, name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", module_name = 0x5556794d2e48 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", has_dynamic_init = 140729938414704, gcc_location = 0x7ffe3dfd0b80, odr_indicator = 140646105882080}}, reg_sites = {3105631075, 32746, 1, 0}, access_size = 93829891701677, size = 224 '\340'}, wild = {addr = 0, access_size = 6137508266440}}}}}, MallocUsableSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}}, SanitizerGetAllocatedSizeNotOwned = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}}, CallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, count = 137416269502240, size = 0}, ReallocArrayOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, count = 137416269502240, size = 0}, PvallocOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, size = 137416269502240}, InvalidAllocationAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, alignment = 137416269502240}, InvalidAlignedAllocAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, size = 137416269502240, alignment = 0}, InvalidPosixMemalignAlignment = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, alignment = 137416269502240}, AllocationSizeTooBig = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, user_size = 137416269502240, total_size = 0, max_size = 0}, RssLimitExceeded = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002}, OutOfMemory = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, requested_size = 137416269502240}, StringFunctionMemoryRangesOverlap = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, length1 = 137416269502240, length2 = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6137508266440, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6137508266440, alloc_tid = 137416269502240, free_tid = 96, alloc_stack_id = 3085833920, free_stack_id = 31994, chunk_access = {bad_addr = 232, offset = 140728898445320, chunk_begin = 140646088202608, chunk_size = 140729938412656, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6137508266440, tid = 137416269502240, offset = 96, frame_pc = 137416269502144, access_size = 232, frame_descr = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>}, global = {addr = 6137508266440, static kMaxGlobals = 4, globals = {{beg = 137416269502240, size = 96, size_with_redzone = 137416269502144, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>, has_dynamic_init = 140646088202608, gcc_location = 0x7ffe3dfd0470, odr_indicator = 2}, {beg = 140646118318016, size = 137210111069072, size_with_redzone = 140729938412608, name = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0xa0 <error: Cannot access memory at address 0xa0>, has_dynamic_init = 137210111069072, gcc_location = 0x7feab86050d0, odr_indicator = 140729938412640}, {beg = 137210111069088, size = 93829890737488, size_with_redzone = 140729938414960, name = 0x7beab6bdd220 "pU\356\267Z|", module_name = 0x7ffe3dfd0c90 "", has_dynamic_init = 140646117598145, gcc_location = 0x7ffe3dfd0460, odr_indicator = 131955619458}, {beg = 140729938412656, size = 2, size_with_redzone = 140646117598208, name = 0x5556794d2e48 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffe3dfd0c70 " \322\275\266\352{", has_dynamic_init = 140729938414464, gcc_location = 0x7feab92e1de0 <_nl_C_locobj>, odr_indicator = 140646104705891}}, reg_sites = {1, 0, 2036153261, 21846}, access_size = 140729938414560, size = 208 '\320'}, wild = {addr = 6137508266440, access_size = 137416269502240}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140646118029207, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140646118029207, alloc_tid = 140729938476288, free_tid = 140729938414200, alloc_stack_id = 982710784, free_stack_id = 4155528343, chunk_access = {bad_addr = 140729938414400, offset = 140646117859197, chunk_begin = 136729074750856, chunk_size = 140646118293368, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140646118029207, tid = 140729938476288, offset = 140729938414200, frame_pc = 17847858331768781312, access_size = 140729938414400, frame_descr = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140646118029207, static kMaxGlobals = 4, globals = {{beg = 140729938476288, size = 140729938414200, size_with_redzone = 17847858331768781312, name = 0x7ffe3dfd0b40 "H\024\356\267\352|", module_name = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136729074750856, gcc_location = 0x7feab9eb7f78, odr_indicator = 65535}, {beg = 17847858331768781312, size = 140646096287928, size_with_redzone = 140646118293368, name = 0x7c4ab7ee7c10 "", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136660355283936, gcc_location = 0x7c4ab7ee7c08, odr_indicator = 136660355283984}, {beg = 93829891626100, size = 64, size_with_redzone = 17031002307140, name = 0x7c6ab7ee1620 "@\024\356\267\352|", module_name = 0x7beab6bdd2c0 "\0166\340E", has_dynamic_init = 136385477427664, gcc_location = 0x5556795cb432 <bt_att_chan_cancel+402>, odr_indicator = 11}, {beg = 136660355283984, size = 11, size_with_redzone = 93829891667704, name = 0x7ceab7ee1440 "", module_name = 0x7beab6bdd320 "", has_dynamic_init = 17031002307160, gcc_location = 0x7ffe3dfd0b50, odr_indicator = 137347550024776}}, reg_sites = {1039994224, 32766, 3097213112, 32746}, access_size = 137072672116736, size = 128 '\200'}, wild = {addr = 140646118029207, access_size = 140729938476288}}}}, function = 0x7feab9de6359 <___interceptor___tls_get_addr(void*)+89> "L\211\360H\213]\360L\213u\370\311\303f.\017\037\204"}, StringFunctionSizeOverflow = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, addr_description = {data = {kind = 3085834016, {shadow = {addr = 0, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 0, alloc_tid = 0, free_tid = 6137508266440, alloc_stack_id = 3085834016, free_stack_id = 31994, chunk_access = {bad_addr = 96, offset = 137416269502144, chunk_begin = 232, chunk_size = 140728898445320, user_requested_alignment = 2416, access_type = 1, alloc_type = 1}}, stack = {addr = 0, tid = 0, offset = 6137508266440, frame_pc = 137416269502240, access_size = 96, frame_descr = 0x7cfab7ee16c0 "\225\005"}, global = {addr = 0, static kMaxGlobals = 4, globals = {{beg = 0, size = 6137508266440, size_with_redzone = 137416269502240, name = 0x60 <error: Cannot access memory at address 0x60>, module_name = 0x7cfab7ee16c0 "\225\005", has_dynamic_init = 232, gcc_location = 0x7ffe00006008, odr_indicator = 140646088202608}, {beg = 140729938412656, size = 2, size_with_redzone = 140646118318016, name = 0x7ccab7ee0b90 "\003\021", module_name = 0x7ffe3dfd0440 "\220\f\375=\376\177", has_dynamic_init = 140646116669240, gcc_location = 0xa0, odr_indicator = 137210111069072}, {beg = 140646092394704, size = 140729938412640, size_with_redzone = 137210111069088, name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136248018457120, gcc_location = 0x7ffe3dfd0c90, odr_indicator = 140646117598145}, {beg = 140729938412640, size = 131955619458, size_with_redzone = 140729938412656, name = 0x2 <error: Cannot access memory at address 0x2>, module_name = 0x7feab9e0e400 <___interceptor_free(void*)+176> "D\213\215\314\367\377\377E\205\311t4H\211m\330A\203\371\001tzE\017\276\3061\311H\211\352H\211\306H\215\275\320\367\377\377\3502\026\001", has_dynamic_init = 93829890649672, gcc_location = 0x7ffe3dfd0c70, odr_indicator = 140729938414464}}, reg_sites = {3106807264, 32746, 3105631075, 32746}, access_size = 1, size = 173 '\255'}, wild = {addr = 0, access_size = 0}}}}, size = 140729938414560}, BadParamsToAnnotateContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, beg = 137416269502240, end = 0, old_mid = 0, new_mid = 6137508266440}, BadParamsToAnnotateDoubleEndedContiguousContainer = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, storage_beg = 137416269502240, storage_end = 0, old_container_beg = 0, old_container_end = 6137508266440, new_container_beg = 137416269502240, new_container_end = 96}, BadParamsToCopyContiguousContainerAnnotations = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, stack = 0xf7b0549700000002, old_storage_beg = 137416269502240, old_storage_end = 0, new_storage_beg = 0, new_storage_end = 6137508266440}, ODRViolation = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, global1 = {beg = 17847858330786070530, size = 137416269502240, size_with_redzone = 0, name = 0x0, module_name = 0x595000001c8 <error: Cannot access memory at address 0x595000001c8>, has_dynamic_init = 137416269502240, gcc_location = 0x60, odr_indicator = 137416269502144}, global2 = {beg = 232, size = 140728898445320, size_with_redzone = 140646088202608, name = 0x7ffe3dfd0470 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140646118318016, gcc_location = 0x7ccab7ee0b90, odr_indicator = 140729938412608}, stack_id1 = 3117594424, stack_id2 = 32746}, InvalidPointerPair = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, pc = 17847858330786070530, bp = 137416269502240, sp = 0, addr1_description = {data = {kind = __asan::kAddressKindWild, {shadow = {addr = 6137508266440, kind = (unknown: 0x20), shadow_byte = 23 '\027'}, heap = {addr = 6137508266440, alloc_tid = 137416269502240, free_tid = 96, alloc_stack_id = 3085833920, free_stack_id = 31994, chunk_access = {bad_addr = 232, offset = 140728898445320, chunk_begin = 140646088202608, chunk_size = 140729938412656, user_requested_alignment = 2, access_type = 0, alloc_type = 0}}, stack = {addr = 6137508266440, tid = 137416269502240, offset = 96, frame_pc = 137416269502144, access_size = 232, frame_descr = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>}, global = {addr = 6137508266440, static kMaxGlobals = 4, globals = {{beg = 137416269502240, size = 96, size_with_redzone = 137416269502144, name = 0xe8 <error: Cannot access memory at address 0xe8>, module_name = 0x7ffe00006008 <error: Cannot access memory at address 0x7ffe00006008>, has_dynamic_init = 140646088202608, gcc_location = 0x7ffe3dfd0470, odr_indicator = 2}, {beg = 140646118318016, size = 137210111069072, size_with_redzone = 140729938412608, name = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248> "H\203;", module_name = 0xa0 <error: Cannot access memory at address 0xa0>, has_dynamic_init = 137210111069072, gcc_location = 0x7feab86050d0, odr_indicator = 140729938412640}, {beg = 137210111069088, size = 93829890737488, size_with_redzone = 140729938414960, name = 0x7beab6bdd220 "pU\356\267Z|", module_name = 0x7ffe3dfd0c90 "", has_dynamic_init = 140646117598145, gcc_location = 0x7ffe3dfd0460, odr_indicator = 131955619458}, {beg = 140729938412656, size = 2, size_with_redzone = 140646117598208, name = 0x5556794d2e48 <gatt_server_cleanup+200> "H\205\333t{\366\303\auvH\211\350H\301\350\003\200\270", module_name = 0x7ffe3dfd0c70 " \322\275\266\352{", has_dynamic_init = 140729938414464, gcc_location = 0x7feab92e1de0 <_nl_C_locobj>, odr_indicator = 140646104705891}}, reg_sites = {1, 0, 2036153261, 21846}, access_size = 140729938414560, size = 208 '\320'}, wild = {addr = 6137508266440, access_size = 137416269502240}}}}, addr2_description = {data = {kind = 8, {shadow = {addr = 140646118029207, kind = __asan::kShadowKindLow, shadow_byte = 253 '\375'}, heap = {addr = 140646118029207, alloc_tid = 140729938476288, free_tid = 140729938414200, alloc_stack_id = 982710784, free_stack_id = 4155528343, chunk_access = {bad_addr = 140729938414400, offset = 140646117859197, chunk_begin = 136729074750856, chunk_size = 140646118293368, user_requested_alignment = 4095, access_type = 3, alloc_type = 3}}, stack = {addr = 140646118029207, tid = 140729938476288, offset = 140729938414200, frame_pc = 17847858331768781312, access_size = 140729938414400, frame_descr = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213"}, global = {addr = 140646118029207, static kMaxGlobals = 4, globals = {{beg = 140729938476288, size = 140729938414200, size_with_redzone = 17847858331768781312, name = 0x7ffe3dfd0b40 "H\024\356\267\352|", module_name = 0x7feab9e4df7d <__sanitizer::DTLS_on_tls_get_addr(void*, void*, unsigned long, unsigned long)+125> "I\211\302H\205\300u\035\351\213", has_dynamic_init = 136729074750856, gcc_location = 0x7feab9eb7f78, odr_indicator = 65535}, {beg = 17847858331768781312, size = 140646096287928, size_with_redzone = 140646118293368, name = 0x7c4ab7ee7c10 "", module_name = 0x7ffe3dfd0d70 "", has_dynamic_init = 136660355283936, gcc_location = 0x7c4ab7ee7c08, odr_indicator = 136660355283984}, {beg = 93829891626100, size = 64, size_with_redzone = 17031002307140, name = 0x7c6ab7ee1620 "@\024\356\267\352|", module_name = 0x7beab6bdd2c0 "\0166\340E", has_dynamic_init = 136385477427664, gcc_location = 0x5556795cb432 <bt_att_chan_cancel+402>, odr_indicator = 11}, {beg = 136660355283984, size = 11, size_with_redzone = 93829891667704, name = 0x7ceab7ee1440 "", module_name = 0x7beab6bdd320 "", has_dynamic_init = 17031002307160, gcc_location = 0x7ffe3dfd0b50, odr_indicator = 137347550024776}}, reg_sites = {1039994224, 32766, 3097213112, 32746}, access_size = 137072672116736, size = 128 '\200'}, wild = {addr = 140646118029207, access_size = 140729938476288}}}}}, Generic = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137416269502240, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137416269502240, tid = 0, offset = 0, frame_pc = 6137508266440, access_size = 137416269502240, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 137416269502240, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6137508266440, name = 0x7cfab7ee1720 "\240\025\356\267j|", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 137416269502144, gcc_location = 0xe8, odr_indicator = 140728898445320}, {beg = 140646088202608, size = 140729938412656, size_with_redzone = 2, name = 0x7feab9ebdfc0 <__asan::instance> "", module_name = 0x7ccab7ee0b90 "\003\021", has_dynamic_init = 140729938412608, gcc_location = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 160}, {beg = 137210111069072, size = 140646092394704, size_with_redzone = 140729938412640, name = 0x7ccab7ee0ba0 "\227\005", module_name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140729938414960, gcc_location = 0x7beab6bdd220, odr_indicator = 140729938414736}, {beg = 140646117598145, size = 140729938412640, size_with_redzone = 131955619458, name = 0x7ffe3dfd0470 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140646117598208, gcc_location = 0x5556794d2e48 <gatt_server_cleanup+200>, odr_indicator = 140729938414704}}, reg_sites = {1039993728, 32766, 3106807264, 32746}, access_size = 140646104705891, size = 1 '\001'}, wild = {addr = 137416269502240, access_size = 0}}}}, pc = 93829891701677, bp = 140729938414560, sp = 140729938414544, access_size = 8, bug_descr = 0x7feab9e77797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}}}, halt_on_error_ = true}
                error = {<__asan::ErrorBase> = {scariness = {score = 51, descr = "8-byte-read-heap-use-after-free\000\352\177\000\000\305|\342\271\352\177\000\000\300\200\356\267J|\000\000:\000\000\000\000\000\000\000\240\200\356\267J|\000\000\260\200\356\267J|\000\000P\000\375=\376\177\000\000\005\334\326\271\352\177\000\000\240\000\375=\376\177\000\000\000P`\270\352\177\000\000\001\000\000\000\000\000\000\000\001\000\000\000V\000\001\001\000\000\000\000\000\000\000\000\370\377\377\377\377\377\377\377\372\200\356\267J|\000\000\220\000\375=\376\177\000\000\001\000\000\000\000\000\000\000:\000\000\000\000\000\000\000\000 }=\376\177\000\000:\000\000\000\000\000\000\000 P\317\266\352{\000\0009\000\000\000"...}, tid = 0}, addr_description = {data = {kind = __asan::kAddressKindHeap, {shadow = {addr = 137416269502240, kind = __asan::kShadowKindLow, shadow_byte = 0 '\000'}, heap = {addr = 137416269502240, alloc_tid = 0, free_tid = 0, alloc_stack_id = 456, free_stack_id = 1429, chunk_access = {bad_addr = 137416269502240, offset = 96, chunk_begin = 137416269502144, chunk_size = 232, user_requested_alignment = 8, access_type = 2, alloc_type = 1}}, stack = {addr = 137416269502240, tid = 0, offset = 0, frame_pc = 6137508266440, access_size = 137416269502240, frame_descr = 0x60 <error: Cannot access memory at address 0x60>}, global = {addr = 137416269502240, static kMaxGlobals = 4, globals = {{beg = 0, size = 0, size_with_redzone = 6137508266440, name = 0x7cfab7ee1720 "\240\025\356\267j|", module_name = 0x60 <error: Cannot access memory at address 0x60>, has_dynamic_init = 137416269502144, gcc_location = 0xe8, odr_indicator = 140728898445320}, {beg = 140646088202608, size = 140729938412656, size_with_redzone = 2, name = 0x7feab9ebdfc0 <__asan::instance> "", module_name = 0x7ccab7ee0b90 "\003\021", has_dynamic_init = 140729938412608, gcc_location = 0x7feab9d2b738 <__sanitizer::Quarantine<__asan::QuarantineCallback, __asan::AsanChunk>::Put(__sanitizer::QuarantineCache<__asan::QuarantineCallback>*, __asan::QuarantineCallback, __asan::AsanChunk*, unsigned long)+248>, odr_indicator = 160}, {beg = 137210111069072, size = 140646092394704, size_with_redzone = 140729938412640, name = 0x7ccab7ee0ba0 "\227\005", module_name = 0x5556794e8550 <device_free> "\363\017\036\372USH\211\373H\203\354\030H\205\377\017\204-\n", has_dynamic_init = 140729938414960, gcc_location = 0x7beab6bdd220, odr_indicator = 140729938414736}, {beg = 140646117598145, size = 140729938412640, size_with_redzone = 131955619458, name = 0x7ffe3dfd0470 "", module_name = 0x2 <error: Cannot access memory at address 0x2>, has_dynamic_init = 140646117598208, gcc_location = 0x5556794d2e48 <gatt_server_cleanup+200>, odr_indicator = 140729938414704}}, reg_sites = {1039993728, 32766, 3106807264, 32746}, access_size = 140646104705891, size = 1 '\001'}, wild = {addr = 137416269502240, access_size = 0}}}}, pc = 93829891701677, bp = 140729938414560, sp = 140729938414544, access_size = 8, bug_descr = 0x7feab9e77797 "heap-use-after-free", is_write = false, shadow_val = 253 '\375'}
        #9  0x00007feab9e1bf8d in __asan::ReportGenericError (pc=<optimized out>, bp=bp@entry=140729938414560, sp=sp@entry=140729938414544, addr=<optimized out>, is_write=is_write@entry=false, access_size=access_size@entry=8, exp=<optimized out>, fatal=true) at ../../../../src/libsanitizer/asan/asan_report.cpp:536
                in_report = <optimized out>
                error = <optimized out>
                enable_fp = <optimized out>
        #10 0x00007feab9e1d3f9 in __asan::__asan_report_load8 (addr=<optimized out>) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:131
                bp = 140729938414560
                pc = <optimized out>
                local_stack = 140729938414960
                sp = 140729938414544
        #11 0x00005556795d3bad in discovery_op_free (op=0x7c6ab7ee16a0) at src/shared/gatt-client.c:407
        No locals.
        #12 0x0000555679700dea in bt_gatt_request_unref (req=0x7c6ab7ee2020) at src/shared/gatt-helpers.c:577
        No locals.
        #13 bt_gatt_request_unref (req=0x7c6ab7ee2020) at src/shared/gatt-helpers.c:566
        No locals.
        #14 0x00005556795c1474 in cancel_att_send_op (data=0x7c4ab7ee7be0) at src/shared/att.c:229
                op = 0x7c4ab7ee7be0
        #15 0x00005556795cc1b9 in bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1954
                chan = 0x7c6ab7ee1620
                entry = 0x7c0ab7ef41d0
        #16 bt_att_cancel_all (att=<optimized out>) at src/shared/att.c:1935
                entry = <optimized out>
                chan = <optimized out>
        #17 0x00005556795ccfa0 in bt_att_unref (att=0x7ceab7ee1440) at src/shared/att.c:1353
        No locals.
        #18 bt_att_unref (att=0x7ceab7ee1440) at src/shared/att.c:1344
        No locals.
        #19 0x00005556794e81bf in attio_cleanup (device=device@entry=0x7d5ab7ee0b00) at src/device.c:873
        No locals.
        #20 0x00005556794e86f7 in device_free (user_data=0x7d5ab7ee0b00) at src/device.c:918
                device = 0x7d5ab7ee0b00
                __func__ = "device_free"
        #21 0x00005556795694aa in remove_interface (data=0x7c5ab7ee5570, name=name@entry=0x55567978f380 "org.bluez.Device1") at gdbus/object.c:742
                iface = 0x7c4ab7ee6260
        #22 0x000055567956c06c in g_dbus_unregister_interface (connection=<optimized out>, path=<optimized out>, name=<optimized out>) at gdbus/object.c:1499
                data = <optimized out>
        #23 0x000055567949e33b in remove_temporary_devices (adapter=adapter@entry=0x7d1ab7ee0200) at src/adapter.c:826
                dev = 0x7d5ab7ee0b00
                l = <optimized out>
                next = 0x0
        #24 0x000055567949f69a in adapter_shutdown () at src/adapter.c:11503
                adapter = 0x7d1ab7ee0200
                list = 0x7c1ab7ee3910 = {0x7d1ab7ee0200}
                __func__ = "adapter_shutdown"
        #25 0x000055567954017c in signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1517
                terminated = false
        #26 signal_callback (signum=<optimized out>, user_data=<optimized out>) at src/main.c:1504
                terminated = false
        #27 0x00005556796f537e in signal_read (io=<optimized out>, user_data=0x7c1ab7ee34c0) at src/shared/mainloop-notify.c:145
                data = <optimized out>
                si = <optimized out>
                result = <optimized out>
                fd = <optimized out>
        #28 0x00005556796f2275 in watch_callback (channel=<optimized out>, cond=<optimized out>, user_data=<optimized out>) at src/shared/io-glib.c:173
                watch = <optimized out>
                result = <optimized out>
                destroy = <optimized out>
        #29 0x00007feab9b27b9b in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #30 0x00007feab9b291d7 in ?? () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #31 0x00007feab9b29577 in g_main_loop_run () from /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
        No symbol table info available.
        #32 0x00005556796f51d9 in mainloop_run () at src/shared/mainloop-glib.c:65
        No locals.
        #33 0x00005556796f5b0b in mainloop_run_with_signal (func=func@entry=0x555679540100 <signal_callback>, user_data=user_data@entry=0x0) at src/shared/mainloop-notify.c:196
                data = 0x7c1ab7ee34c0
                io = 0x7c2ab7ef9590
                ret = <optimized out>
        #34 0x00005556792713eb in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:1745
                context = <optimized out>
                err = <optimized out>
                sdp_mtu = 0
                sdp_flags = <optimized out>
                gdbus_flags = <optimized out>
                __func__ = "main""
FAIL functional.test_bap::test_bass_past_transport_acquire[hosts9-vm2]: AssertionError: Failed to acquire: org.bluez.Error.Failed
FAIL functional.test_bap::test_bass_past_earbuds_transport_acquire[hosts11-vm3]: AssertionError: Failed to acquire: org.bluez.Error.Failed


https://github.com/bluez/bluez/pull/2772

---
Regards,
Linux Bluetooth

[PATCH BlueZ v2 2/8] unit/test-gatt: Add malformed Read By Type response tests

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add tests for Read By Type responses with invalid Attribute Data Length,
truncated data, empty values and an empty Server Features value.

Assisted-by: OpenCode:claude-opus-5.5
---
 unit/test-gatt.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index 6d6d0c73ed40..26768e1aca82 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -2064,6 +2064,18 @@ static const struct test_step test_read_by_type_6 = {
 	.expected_att_ecode = 0x0c,
 };
 
+static const struct test_step test_read_by_type_malformed = {
+	.handle = 0x0001,
+	.end_handle = 0xffff,
+};
+
+static const struct test_step test_read_by_type_empty = {
+	.handle = 0x0001,
+	.end_handle = 0xffff,
+	.expected_att_ecode = 0x0a,
+	.value = read_data_1,
+};
+
 static void multiple_read_cb(bool success, uint8_t att_ecode,
 					const uint8_t *value, uint16_t length,
 					void *user_data)
@@ -2146,6 +2158,7 @@ static void read_by_type_cb(bool success, uint8_t att_ecode,
 	struct bt_gatt_iter iter;
 
 	g_assert(att_ecode == step->expected_att_ecode);
+	g_assert(success == !!step->value);
 
 	if (success) {
 		uint16_t length, handle;
@@ -2957,6 +2970,81 @@ int main(int argc, char *argv[])
 			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
 			raw_pdu(0x01, 0x08, 0x0b, 0x00, 0x0c));
 
+	define_test_att("/read-by-type/zero-data-length", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x00, 0x0a, 0x00));
+
+	define_test_att("/read-by-type/short-data-length", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x01, 0x0a, 0x00));
+
+	define_test_att("/read-by-type/missing-data", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x12));
+
+	define_test_att("/read-by-type/short-handle", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x02, 0x0a));
+
+	define_test_att("/read-by-type/oversized-data-length",
+			test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x04, 0x0a, 0x00));
+
+	define_test_att("/read-by-type/truncated-data", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_malformed,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x03, 0x0a, 0x00, 0x01, 0x0b));
+
+	define_test_att("/read-by-type/empty-value", test_read_by_type,
+			&uuid_char_16, &test_read_by_type_empty,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x09, 0x02, 0x0a, 0x00),
+			raw_pdu(0x08, 0x0b, 0x00, 0xff, 0xff, 0x0d, 0x2a),
+			raw_pdu(0x01, 0x08, 0x0b, 0x00, 0x0a));
+
+	define_test_client("/read-by-type/empty-server-features", test_client,
+			service_db_1, NULL,
+			MTU_EXCHANGE_CLIENT_PDUS,
+			raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x3a, 0x2b),
+			raw_pdu(0x09, 0x02, 0xff, 0xff),
+			raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),
+			raw_pdu(0x11, 0x06, 0x01, 0x00, 0x04, 0x00, 0x01,
+					0x18),
+			raw_pdu(0x10, 0x05, 0x00, 0xff, 0xff, 0x00, 0x28),
+			raw_pdu(0x11, 0x06, 0x05, 0x00, 0x08, 0x00, 0x0d,
+					0x18),
+			raw_pdu(0x10, 0x09, 0x00, 0xff, 0xff, 0x00, 0x28),
+			raw_pdu(0x01, 0x10, 0x09, 0x00, 0x0a),
+			raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x01, 0x28),
+			raw_pdu(0x01, 0x10, 0x01, 0x00, 0x0a),
+			raw_pdu(0x08, 0x01, 0x00, 0x08, 0x00, 0x02, 0x28),
+			raw_pdu(0x01, 0x08, 0x01, 0x00, 0x0a),
+			raw_pdu(0x08, 0x01, 0x00, 0x08, 0x00, 0x03, 0x28),
+			raw_pdu(0x09, 0x07, 0x02, 0x00, 0x02, 0x03, 0x00,
+					0x00, 0x2a),
+			raw_pdu(0x08, 0x03, 0x00, 0x08, 0x00, 0x03, 0x28),
+			raw_pdu(0x09, 0x07, 0x06, 0x00, 0x0a, 0x07, 0x00,
+					0x29, 0x2a),
+			raw_pdu(0x08, 0x07, 0x00, 0x08, 0x00, 0x03, 0x28),
+			raw_pdu(0x01, 0x08, 0x07, 0x00, 0x0a),
+			raw_pdu(0x04, 0x04, 0x00, 0x04, 0x00),
+			raw_pdu(0x05, 0x01, 0x04, 0x00, 0x01, 0x29),
+			raw_pdu(0x04, 0x08, 0x00, 0x08, 0x00),
+			raw_pdu(0x05, 0x01, 0x08, 0x00, 0x01, 0x29));
+
 	define_test_server("/TP/GAR/SR/BV-03-C/small", test_server, ts_small_db,
 			NULL,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0

[PATCH BlueZ v2 3/8] shared/gatt-client: Fix handling of short notifications

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

A Handle Value Notification or Indication shorter than a handle made
notify_cb read the handle past the PDU and wrap the value length to
65534, passing a value larger than the received buffer to the
registered handlers. Ignore such PDUs.

Fixes: 151582e6a343 ("shared/gatt-client: Handle incoming not/ind PDUs.")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 09bd9c971ee5..2b6da611b9f1 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2299,6 +2299,9 @@ static void notify_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 			pdu += data.len;
 		}
 	} else {
+		if (length < 2)
+			goto done;
+
 		data.handle = get_le16(pdu);
 		length -= 2;
 		pdu += 2;
-- 
2.56.0

[PATCH BlueZ v2 4/8] unit/test-gatt: Add short notification test

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Assisted-by: OpenCode:claude-opus-5.5
---
 unit/test-gatt.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index 26768e1aca82..d032e7598f9b 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -2334,6 +2334,41 @@ static const struct test_step test_notification_1 = {
 	.length = 0x03,
 };
 
+static void notification_short_cb(uint16_t value_handle,
+					const uint8_t *value, uint16_t length,
+					void *user_data)
+{
+	struct context *context = user_data;
+	const struct test_step *step = context->data->step;
+	static int count;
+
+	g_assert_cmpint(value_handle, ==, step->handle);
+	g_assert_cmpint(length, ==, step->length);
+	g_assert(memcmp(value, step->value, length) == 0);
+
+	if (++count == 2) {
+		count = 0;
+		context_quit(context);
+	}
+}
+
+static void test_notification_short(struct context *context)
+{
+	const struct test_step *step = context->data->step;
+
+	g_assert(bt_gatt_client_register_notify(context->client, step->handle,
+						notification_register_cb,
+						notification_short_cb, context,
+						NULL));
+}
+
+static const struct test_step test_notification_short_1 = {
+	.handle = 0x0003,
+	.func = test_notification_short,
+	.value = read_data_1,
+	.length = 0x03,
+};
+
 static void test_server_notification(struct context *context)
 {
 	const struct test_step *step = context->data->step;
@@ -3481,6 +3516,21 @@ int main(int argc, char *argv[])
 			raw_pdu(),
 			raw_pdu(0x1B, 0x03, 0x00, 0x01, 0x02, 0x03));
 
+	define_test_client("/robustness/notify-short", test_client,
+			ts_small_db, &test_notification_short_1,
+			CLIENT_INIT_PDUS,
+			SMALL_DB_DISCOVERY_PDUS,
+			raw_pdu(0x12, 0x04, 0x00, 0x01, 0x00),
+			raw_pdu(0x13),
+			raw_pdu(),
+			raw_pdu(0x1B, 0x03, 0x00, 0x01, 0x02, 0x03),
+			raw_pdu(),
+			raw_pdu(0x1B),
+			raw_pdu(),
+			raw_pdu(0x1B, 0x03),
+			raw_pdu(),
+			raw_pdu(0x1B, 0x03, 0x00, 0x01, 0x02, 0x03));
+
 	define_test_server("/TP/GAN/SR/BV-01-C", test_server, ts_small_db,
 			&test_notification_server_1,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0

[PATCH BlueZ v2 5/8] shared/att: Add Read Multiple Variable Length opcodes

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

READ_MULT_VL_REQ/RSP were missing from the opcode type and
request/response tables, so bt_att_send rejected the response and the
server never answered the request, leaving the peer to time out. The
client could not send the request either.

Fixes: 3c5088f040ac ("shared/gatt-server: Add support for Read Multiple Variable Length")
Fixes: 6ea204dca0b2 ("shared/gatt-client: Add support for Read Multiple Variable Length")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/att.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/shared/att.c b/src/shared/att.c
index e49743b5a764..3055f291f8f1 100644
--- a/src/shared/att.c
+++ b/src/shared/att.c
@@ -129,6 +129,8 @@ static const struct {
 	{ BT_ATT_OP_READ_BLOB_RSP,		ATT_OP_TYPE_RSP },
 	{ BT_ATT_OP_READ_MULT_REQ,		ATT_OP_TYPE_REQ },
 	{ BT_ATT_OP_READ_MULT_RSP,		ATT_OP_TYPE_RSP },
+	{ BT_ATT_OP_READ_MULT_VL_REQ,		ATT_OP_TYPE_REQ },
+	{ BT_ATT_OP_READ_MULT_VL_RSP,		ATT_OP_TYPE_RSP },
 	{ BT_ATT_OP_READ_BY_GRP_TYPE_REQ,	ATT_OP_TYPE_REQ },
 	{ BT_ATT_OP_READ_BY_GRP_TYPE_RSP,	ATT_OP_TYPE_RSP },
 	{ BT_ATT_OP_WRITE_REQ,			ATT_OP_TYPE_REQ },
@@ -172,6 +174,7 @@ static const struct {
 	{ BT_ATT_OP_READ_REQ,			BT_ATT_OP_READ_RSP },
 	{ BT_ATT_OP_READ_BLOB_REQ,		BT_ATT_OP_READ_BLOB_RSP },
 	{ BT_ATT_OP_READ_MULT_REQ,		BT_ATT_OP_READ_MULT_RSP },
+	{ BT_ATT_OP_READ_MULT_VL_REQ,		BT_ATT_OP_READ_MULT_VL_RSP },
 	{ BT_ATT_OP_READ_BY_GRP_TYPE_REQ,	BT_ATT_OP_READ_BY_GRP_TYPE_RSP },
 	{ BT_ATT_OP_WRITE_REQ,			BT_ATT_OP_WRITE_RSP },
 	{ BT_ATT_OP_PREP_WRITE_REQ,		BT_ATT_OP_PREP_WRITE_RSP },
-- 
2.56.0

[PATCH BlueZ v2 6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The Length Value Tuple loop never advanced past each value, and a
length exceeding the remaining data grew the remaining length instead
of truncating the value, passing data past the end of the PDU to the
callback.

Also hold a reference to the request while dispatching the values and
stop if a callback cancels it, since that would free the request.

Fixes: 6ea204dca0b2 ("shared/gatt-client: Add support for Read Multiple Variable Length")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 2b6da611b9f1..4a8bdfc441d4 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2929,8 +2929,11 @@ static void read_multiple_cb(uint8_t opcode, const void *pdu, uint16_t length,
 		return;
 	}
 
+	/* Keep the request alive in case a callback cancels it */
+	request_ref(req);
+
 	/* Parse response */
-	while (length >= 2) {
+	while (length >= 2 && !req->removed) {
 		uint16_t len;
 
 		len = get_le16(pdu);
@@ -2942,10 +2945,15 @@ static void read_multiple_cb(uint8_t opcode, const void *pdu, uint16_t length,
 		 * current ATT_MTU.
 		 */
 		if (len > length)
-			length = len;
+			len = length;
 
 		op->callback(success, att_ecode, pdu, len, op->user_data);
+
+		length -= len;
+		pdu += len;
 	}
+
+	request_unref(req);
 }
 
 unsigned int bt_gatt_client_read_multiple(struct bt_gatt_client *client,
-- 
2.56.0

[PATCH BlueZ v2 7/8] shared/gatt-client: Check value lengths before reading them

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Check the iterator result when reading the Database Hash and avoid
reading the Extended Properties value when the response is empty.

Fixes: 0f67d5e2f19f ("shared/gatt-client: Read database hash if available")
Fixes: 6b3f0f3ab935 ("gatt-client: Read extended props on service discovery")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 4a8bdfc441d4..a923699b74bb 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -887,7 +887,8 @@ static void ext_prop_read_cb(bool success, uint8_t att_ecode,
 	if (!success)
 		goto done;
 
-	DBG(client, "Ext. prop value: 0x%04x", (uint16_t)value[0]);
+	DBG(client, "Ext. prop value: 0x%04x",
+				length ? (uint16_t)value[0] : 0);
 
 	desc_attr = queue_pop_head(op->ext_prop_desc);
 	if (!desc_attr)
@@ -1475,8 +1476,10 @@ static void db_hash_read_cb(bool success, uint8_t att_ecode,
 	if (!success)
 		goto discover;
 
-	bt_gatt_iter_init(&iter, result);
-	bt_gatt_iter_next_read_by_type(&iter, &handle, &len, &value);
+	if (!bt_gatt_iter_init(&iter, result) ||
+			!bt_gatt_iter_next_read_by_type(&iter, &handle,
+							&len, &value))
+		goto discover;
 
 	DBG(client, "DB Hash found: handle 0x%04x length 0x%04x",
 							handle, len);
-- 
2.56.0

[PATCH BlueZ v2 8/8] unit/test-gatt: Add Read Multiple Variable Length tests

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Add client tests, using EATT client features, for regular and truncated
responses and for cancelling the request from the callback, and a
server test for the response.

Assisted-by: OpenCode:claude-opus-5.5
---
 unit/test-gatt.c | 169 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 165 insertions(+), 4 deletions(-)

diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index d032e7598f9b..267bcc61802e 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -119,6 +119,29 @@ struct context {
 		MTU_EXCHANGE_CLIENT_PDUS,				\
 		READ_SERVER_FEAT_PDUS
 
+#define EATT_CLIENT_INIT_PDUS						\
+		MTU_EXCHANGE_CLIENT_PDUS,				\
+		raw_pdu(0x08, 0x01, 0x00, 0xff, 0xff, 0x3a, 0x2b),	\
+		raw_pdu(0x09, 0x03, 0x03, 0x00, 0x01),			\
+		raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),	\
+		raw_pdu(0x11, 0x06, 0x01, 0x00, 0x05, 0x00, 0x01, 0x18),\
+		raw_pdu(0x08, 0x04, 0x00, 0xff, 0xff, 0x3a, 0x2b),	\
+		raw_pdu(0x01, 0x08, 0x04, 0x00, 0x0a),			\
+		raw_pdu(0x10, 0x06, 0x00, 0xff, 0xff, 0x00, 0x28),	\
+		raw_pdu(0x01, 0x10, 0x06, 0x00, 0x0a),			\
+		raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x01, 0x28),	\
+		raw_pdu(0x01, 0x10, 0x01, 0x00, 0x0a),			\
+		raw_pdu(0x08, 0x01, 0x00, 0x05, 0x00, 0x02, 0x28),	\
+		raw_pdu(0x01, 0x08, 0x01, 0x00, 0x0a),			\
+		raw_pdu(0x08, 0x01, 0x00, 0x05, 0x00, 0x03, 0x28),	\
+		raw_pdu(0x09, 0x07, 0x02, 0x00, 0x02, 0x03, 0x00, 0x3a,	\
+				0x2b, 0x04, 0x00, 0x0a, 0x05, 0x00, 0x29,\
+				0x2b),					\
+		raw_pdu(0x08, 0x05, 0x00, 0x05, 0x00, 0x03, 0x28),	\
+		raw_pdu(0x01, 0x08, 0x05, 0x00, 0x0a),			\
+		raw_pdu(0x12, 0x05, 0x00, 0x07),			\
+		raw_pdu(0x13)
+
 #define SERVICE_DATA_1_PDUS						\
 		CLIENT_INIT_PDUS,					\
 		raw_pdu(0x10, 0x01, 0x00, 0xff, 0xff, 0x00, 0x28),	\
@@ -328,6 +351,7 @@ struct test_step {
 	uint8_t expected_att_ecode;
 	const uint8_t *value;
 	uint16_t length;
+	uint8_t features;
 };
 
 static void destroy_context(struct context *context)
@@ -624,7 +648,7 @@ static void client_ready_cb(bool success, uint8_t att_ecode, void *user_data)
 
 	g_assert(success);
 
-	if (!context->data->source_db) {
+	if (!context->data->source_db && !context->data->step) {
 		context_quit(context);
 		return;
 	}
@@ -632,8 +656,10 @@ static void client_ready_cb(bool success, uint8_t att_ecode, void *user_data)
 	g_assert(context->client);
 	g_assert(context->client_db);
 
-	gatt_db_foreach_service(context->client_db, NULL, match_services,
-						context->data->source_db);
+	if (context->data->source_db)
+		gatt_db_foreach_service(context->client_db, NULL,
+					match_services,
+					context->data->source_db);
 
 	if (context->data->step) {
 		const struct test_step *step = context->data->step;
@@ -653,6 +679,7 @@ static struct context *create_context(uint16_t mtu, gconstpointer data)
 {
 	struct context *context = g_new0(struct context, 1);
 	const struct test_data *test_data = data;
+	const struct test_step *step;
 	GIOChannel *channel;
 	int err, sv[2];
 
@@ -680,11 +707,14 @@ static struct context *create_context(uint16_t mtu, gconstpointer data)
 						"bt_gatt_server:", NULL);
 		break;
 	case CLIENT:
+		step = test_data->step;
+
 		context->client_db = gatt_db_new();
 		g_assert(context->client_db);
 
 		context->client = bt_gatt_client_new(context->client_db,
-							context->att, mtu, 0);
+						context->att, mtu,
+						step ? step->features : 0);
 		g_assert(context->client);
 
 		bt_gatt_client_set_debug(context->client, print_debug,
@@ -2149,6 +2179,109 @@ static const struct test_step test_multiple_read_6 = {
 	.expected_att_ecode = 0x0c
 };
 
+static void multiple_read_vl_cb(bool success, uint8_t att_ecode,
+					const uint8_t *value, uint16_t length,
+					void *user_data)
+{
+	struct context *context = user_data;
+	const struct test_step *step = context->data->step;
+	static uint16_t offset;
+
+	g_assert(success);
+	g_assert_cmpint(offset + 2 + length, <=, step->length);
+	g_assert_cmpint(get_le16(step->value + offset), ==, length);
+	g_assert(memcmp(value, step->value + offset + 2, length) == 0);
+
+	offset += 2 + length;
+	if (offset == step->length) {
+		offset = 0;
+		context_quit(context);
+	}
+}
+
+static void test_multiple_read_vl(struct context *context)
+{
+	const struct test_step *step = context->data->step;
+	uint16_t handles[2];
+
+	handles[0] = step->handle;
+	handles[1] = step->end_handle;
+
+	g_assert(bt_gatt_client_read_multiple(context->client, handles, 2,
+						multiple_read_vl_cb, context,
+						NULL));
+}
+
+static const uint8_t read_mult_vl_data_1[] = {
+	0x02, 0x00, 0x01, 0x02,
+	0x03, 0x00, 0x03, 0x04, 0x05
+};
+
+static const struct test_step test_multiple_read_vl_1 = {
+	.handle = 0x0003,
+	.end_handle = 0x0005,
+	.func = test_multiple_read_vl,
+	.value = read_mult_vl_data_1,
+	.length = sizeof(read_mult_vl_data_1),
+	.features = BT_GATT_CHRC_CLI_FEAT_EATT,
+};
+
+static const uint8_t read_mult_vl_data_2[] = {
+	0x02, 0x00, 0x01, 0x02,
+	0x01, 0x00, 0x03
+};
+
+static const struct test_step test_multiple_read_vl_2 = {
+	.handle = 0x0003,
+	.end_handle = 0x0005,
+	.func = test_multiple_read_vl,
+	.value = read_mult_vl_data_2,
+	.length = sizeof(read_mult_vl_data_2),
+	.features = BT_GATT_CHRC_CLI_FEAT_EATT,
+};
+
+static unsigned int multiple_read_vl_id;
+
+static void multiple_read_vl_cancel_cb(bool success, uint8_t att_ecode,
+					const uint8_t *value, uint16_t length,
+					void *user_data)
+{
+	struct context *context = user_data;
+	const struct test_step *step = context->data->step;
+
+	g_assert(success);
+	g_assert_cmpint(get_le16(step->value), ==, length);
+	g_assert(memcmp(value, step->value + 2, length) == 0);
+
+	g_assert(bt_gatt_client_cancel(context->client, multiple_read_vl_id));
+	multiple_read_vl_id = 0;
+
+	context_quit(context);
+}
+
+static void test_multiple_read_vl_cancel(struct context *context)
+{
+	const struct test_step *step = context->data->step;
+	uint16_t handles[2];
+
+	handles[0] = step->handle;
+	handles[1] = step->end_handle;
+
+	multiple_read_vl_id = bt_gatt_client_read_multiple(context->client,
+					handles, 2, multiple_read_vl_cancel_cb,
+					context, NULL);
+	g_assert(multiple_read_vl_id);
+}
+
+static const struct test_step test_multiple_read_vl_3 = {
+	.handle = 0x0003,
+	.end_handle = 0x0005,
+	.func = test_multiple_read_vl_cancel,
+	.value = read_mult_vl_data_1,
+	.length = sizeof(read_mult_vl_data_1),
+	.features = BT_GATT_CHRC_CLI_FEAT_EATT,
+};
+
 static void read_by_type_cb(bool success, uint8_t att_ecode,
 						struct bt_gatt_result *result,
 						void *user_data)
@@ -3378,6 +3511,27 @@ int main(int argc, char *argv[])
 			raw_pdu(0x0e, 0x03, 0x00, 0x07, 0x00),
 			raw_pdu(0x0f, 0x01, 0x02, 0x03));
 
+	define_test_client("/robustness/read-multiple-vl", test_client,
+			NULL, &test_multiple_read_vl_1,
+			EATT_CLIENT_INIT_PDUS,
+			raw_pdu(0x20, 0x03, 0x00, 0x05, 0x00),
+			raw_pdu(0x21, 0x02, 0x00, 0x01, 0x02, 0x03, 0x00,
+					0x03, 0x04, 0x05));
+
+	define_test_client("/robustness/read-multiple-vl-truncated",
+			test_client, NULL, &test_multiple_read_vl_2,
+			EATT_CLIENT_INIT_PDUS,
+			raw_pdu(0x20, 0x03, 0x00, 0x05, 0x00),
+			raw_pdu(0x21, 0x02, 0x00, 0x01, 0x02, 0x03, 0x00,
+					0x03));
+
+	define_test_client("/robustness/read-multiple-vl-cancel",
+			test_client, NULL, &test_multiple_read_vl_3,
+			EATT_CLIENT_INIT_PDUS,
+			raw_pdu(0x20, 0x03, 0x00, 0x05, 0x00),
+			raw_pdu(0x21, 0x02, 0x00, 0x01, 0x02, 0x03, 0x00,
+					0x03, 0x04, 0x05));
+
 	define_test_client("/TP/GAR/CL/BI-22-C", test_client, service_db_1,
 			&test_multiple_read_6,
 			SERVICE_DATA_1_PDUS,
@@ -3390,6 +3544,13 @@ int main(int argc, char *argv[])
 			raw_pdu(0x0e, 0x15, 0xF0, 0x03, 0x00),
 			raw_pdu(0x0f, 0x09, 'B', 'l', 'u', 'e', 'Z'));
 
+	define_test_server("/robustness/read-multiple-vl/server",
+			test_server, ts_small_db, NULL,
+			raw_pdu(0x03, 0x00, 0x02),
+			raw_pdu(0x20, 0x15, 0xF0, 0x03, 0x00),
+			raw_pdu(0x21, 0x01, 0x00, 0x09, 0x05, 0x00, 'B', 'l',
+					'u', 'e', 'Z'));
+
 	define_test_server("/TP/GAR/SR/BV-05-C/large-1", test_server,
 			ts_large_db_1, NULL,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0

Re: [PATCH BlueZ v2 0/8] Fix handling of malformed GATT PDUs

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri,  6 Nov 2026 13:33:42 -0500 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> This fixes several places where GATT PDUs received from the peer are
> used without proper validation:
> 
>  - Read By Type responses with an invalid Attribute Data Length could
>    cause a division by zero and out-of-bounds reads during discovery.
>  - Notifications and indications shorter than a handle wrapped the
>    value length to 65534, passing data past the received buffer to the
>    registered handlers.
>  - Read Multiple Variable Length opcodes were missing from the ATT
>    tables, so the server never responded to the request, and the
>    client response parser did not advance past each value.
>  - Database Hash and Extended Properties values were read without
>    checking their length.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v2,1/8] shared/gatt: Validate Read By Type responses
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=02acfdbe0374
  - [BlueZ,v2,2/8] unit/test-gatt: Add malformed Read By Type response tests
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=730d0138bf30
  - [BlueZ,v2,3/8] shared/gatt-client: Fix handling of short notifications
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=2d41b1aab0b8
  - [BlueZ,v2,4/8] unit/test-gatt: Add short notification test
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=ea2ab6628b8d
  - [BlueZ,v2,5/8] shared/att: Add Read Multiple Variable Length opcodes
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=0c2f60273e63
  - [BlueZ,v2,6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=3b15e6d5bb70
  - [BlueZ,v2,7/8] shared/gatt-client: Check value lengths before reading them
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=bf1fd8831d56
  - [BlueZ,v2,8/8] unit/test-gatt: Add Read Multiple Variable Length tests
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=aa4f5ce97c87

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html