[PATCH BlueZ] a2dp: Fix loading of remote SEP from cache

[Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>]

Commit 912f5efb0dd9 ("a2dp: Fix handling of codec capability storage")
added an 'i >= 2' condition to the loop that parses the stored codec
capabilities. Since i starts at 0 the loop body never runs, i stays 0,
and the subsequent 'if (i != size)' check discards every endpoint found
in the cache:

  load_remote_sep() Unable to load LastUsed: rseid 6 not found

With no remote SEP loaded, avdtp_discover() can no longer take the
cached path and issues AVDTP Discover/Get All Capabilities on every
reconnect, and a2dp_setup_remote_path() returns NULL so the transport
ends up at /org/bluez/hciX/dev_YY/fd0 instead of .../sepN/fd0.

The condition was presumably meant to bound the writes into data[128],
which the original commit did not actually fix: caps is read with
'%512s' so size / 2 can be up to 256. Validate size up front instead.

Fixes: 912f5efb0dd9 ("a2dp: Fix handling of codec capability storage")
---

Reproduced on Fedora Rawhide with bluez-5.87-2.fc45 and a pair of
Denon PerL Pro TWS earbuds. Without cached remote SEPs the earbuds'
incoming AVDTP Set Configuration races with the discovery bluetoothd
now has to perform, the stream never leaves CONFIGURED, and any client
opening the sink stalls. Fixed with this patch.

 profiles/audio/a2dp.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index c8adc3122..a4ba1dacf 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -2398,7 +2398,16 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
 			delay_reporting = false;
 		}
 
-		for (i = 0, size = strlen(caps); i < size && i >= 2; i += 2) {
+		size = strlen(caps);
+
+		g_free(value);
+
+		if (size % 2 || size / 2 > (int) sizeof(data)) {
+			warn("Unable to load Endpoint: seid %u", rseid);
+			continue;
+		}
+
+		for (i = 0; i < size; i += 2) {
 			uint8_t *tmp = data + i / 2;
 
 			if (sscanf(caps + i, "%02hhx", tmp) != 1) {
@@ -2407,8 +2416,6 @@ static void load_remote_sep(struct a2dp_channel *chan, GKeyFile *key_file,
 			}
 		}
 
-		g_free(value);
-
 		if (i != size)
 			continue;
 
-- 
2.55.0