From: "Frédéric Danis" <frederic.danis@collabora.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ v2 0/5] audio/avrcp: Fix crash with invalid UTF-8 item name
Date: Tue, 8 Jul 2025 09:08:17 +0200 [thread overview]
Message-ID: <20250708070822.185375-1-frederic.danis@collabora.com> (raw)
As stated in AVRCP 1.6.2 chapter 6.10.2.3 Media element item, for the
Displayable Name Length property, the target device may truncate the
item name:
Length of Displayable Name in octets. The name shall be limited such
that a response to a GetFolderItems containing one media player item
fits within the maximum size of PDU which can be received by the CT.
This truncatation may occur in the middle of a multi-byte character,
at least with Samsung Music app, which triggers a DBus assertion and
crashes bluetoothd:
profiles/audio/player.c:media_folder_create_item() Din Dhal Jaye
Haye with lyrics | "दिन ढल जाए
हाय" गाने के बो� type audio uid 1
profiles/audio/player.c:media_folder_create_item()
/org/bluez/hci0/dev_24_24_B7_11_82_6C/player0/NowPlaying/item1
profiles/audio/player.c:media_player_set_metadata() Title: Din Dhal
Jaye Haye with lyrics | "दिन ढल जाए हाय"
गाने के बोल | Guide | Dev Anand, Waheeda Rehman
…
arguments to dbus_message_iter_append_basic() were incorrect,
assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in
file dbus-message.c line 2775.
This is normally a bug in some application using the D-Bus library.
v1->v2:
- Introduce new strtoutf8() util function to truncate a string before
the first non UTF-8 character.
- Use strtoutf8() for AVRCP media element name
- Use strtoutf8() for MCP player name and track title
- Use strtoutf8() for Audio GAP device name
- Use strtoutf8() for EIR device names
Frédéric Danis (5):
shared/util: Add strtoutf8 function
audio/avrcp: Fix crash with invalid UTF-8 item name
audio/mcp: Use strtoutf8 for player name and track title
audio/gap: Use strtoutf8 for GAP device name
eir: Use strtoutf8 for device names
profiles/audio/avrcp.c | 4 +++-
profiles/audio/mcp.c | 11 +----------
profiles/gap/gas.c | 11 +----------
src/eir.c | 11 +----------
src/shared/util.c | 42 ++++++++++++++++++++++++++++++++++++++++++
src/shared/util.h | 1 +
6 files changed, 49 insertions(+), 31 deletions(-)
--
2.43.0
next reply other threads:[~2025-07-08 7:08 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-08 7:08 Frédéric Danis [this message]
2025-07-08 7:08 ` [PATCH BlueZ v2 1/5] shared/util: Add strtoutf8 function Frédéric Danis
2025-07-08 8:32 ` audio/avrcp: Fix crash with invalid UTF-8 item name bluez.test.bot
2025-07-08 13:55 ` [PATCH BlueZ v2 1/5] shared/util: Add strtoutf8 function Luiz Augusto von Dentz
2025-07-08 7:08 ` [PATCH BlueZ v2 2/5] audio/avrcp: Fix crash with invalid UTF-8 item name Frédéric Danis
2025-07-08 7:08 ` [PATCH BlueZ v2 3/5] audio/mcp: Use strtoutf8 for player name and track title Frédéric Danis
2025-07-08 7:08 ` [PATCH BlueZ v2 4/5] audio/gap: Use strtoutf8 for GAP device name Frédéric Danis
2025-07-08 7:08 ` [PATCH BlueZ v2 5/5] eir: Use strtoutf8 for device names Frédéric Danis
2025-07-08 8:05 ` [PATCH BlueZ v2 0/5] audio/avrcp: Fix crash with invalid UTF-8 item name Bastien Nocera
2025-07-08 14:01 ` Luiz Augusto von Dentz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250708070822.185375-1-frederic.danis@collabora.com \
--to=frederic.danis@collabora.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox