[PATCH BlueZ v1 6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The Length Value Tuple loop never advanced past each value, and a
length exceeding the remaining data grew the remaining length instead
of truncating the value, passing data past the end of the PDU to the
callback.

Fixes: 6ea204dca0b2 ("shared/gatt-client: Add support for Read Multiple Variable Length")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 2b6da611b9f1..6902903e7b02 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2942,9 +2942,12 @@ static void read_multiple_cb(uint8_t opcode, const void *pdu, uint16_t length,
 		 * current ATT_MTU.
 		 */
 		if (len > length)
-			length = len;
+			len = length;
 
 		op->callback(success, att_ecode, pdu, len, op->user_data);
+
+		length -= len;
+		pdu += len;
 	}
 }
 
-- 
2.56.0