[PATCH BlueZ v2 0/8] Fix handling of malformed GATT PDUs

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes several places where GATT PDUs received from the peer are
used without proper validation:

 - Read By Type responses with an invalid Attribute Data Length could
   cause a division by zero and out-of-bounds reads during discovery.
 - Notifications and indications shorter than a handle wrapped the
   value length to 65534, passing data past the received buffer to the
   registered handlers.
 - Read Multiple Variable Length opcodes were missing from the ATT
   tables, so the server never responded to the request, and the
   client response parser did not advance past each value.
 - Database Hash and Extended Properties values were read without
   checking their length.

The Read By Type, notification and Read Multiple Variable Length fixes
come with unit tests reproducing the problem.

v2:
 - Fix use-after-free when a callback cancels a Read Multiple Variable
   Length request while its values are being dispatched, and add a test
   for it.

Luiz Augusto von Dentz (8):
  shared/gatt: Validate Read By Type responses
  unit/test-gatt: Add malformed Read By Type response tests
  shared/gatt-client: Fix handling of short notifications
  unit/test-gatt: Add short notification test
  shared/att: Add Read Multiple Variable Length opcodes
  shared/gatt-client: Fix parsing Read Multiple Variable Length response
  shared/gatt-client: Check value lengths before reading them
  unit/test-gatt: Add Read Multiple Variable Length tests

 src/shared/att.c          |   3 +
 src/shared/gatt-client.c  |  30 +++-
 src/shared/gatt-helpers.c |   7 +-
 unit/test-gatt.c          | 307 +++++++++++++++++++++++++++++++++++++-
 4 files changed, 333 insertions(+), 14 deletions(-)

-- 
2.56.0