[PATCH BlueZ v2 6/8] shared/gatt-client: Fix parsing Read Multiple Variable Length response

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The Length Value Tuple loop never advanced past each value, and a
length exceeding the remaining data grew the remaining length instead
of truncating the value, passing data past the end of the PDU to the
callback.

Also hold a reference to the request while dispatching the values and
stop if a callback cancels it, since that would free the request.

Fixes: 6ea204dca0b2 ("shared/gatt-client: Add support for Read Multiple Variable Length")
Assisted-by: OpenCode:claude-opus-5.5
---
 src/shared/gatt-client.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 2b6da611b9f1..4a8bdfc441d4 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -2929,8 +2929,11 @@ static void read_multiple_cb(uint8_t opcode, const void *pdu, uint16_t length,
 		return;
 	}
 
+	/* Keep the request alive in case a callback cancels it */
+	request_ref(req);
+
 	/* Parse response */
-	while (length >= 2) {
+	while (length >= 2 && !req->removed) {
 		uint16_t len;
 
 		len = get_le16(pdu);
@@ -2942,10 +2945,15 @@ static void read_multiple_cb(uint8_t opcode, const void *pdu, uint16_t length,
 		 * current ATT_MTU.
 		 */
 		if (len > length)
-			length = len;
+			len = length;
 
 		op->callback(success, att_ecode, pdu, len, op->user_data);
+
+		length -= len;
+		pdu += len;
 	}
+
+	request_unref(req);
 }
 
 unsigned int bt_gatt_client_read_multiple(struct bt_gatt_client *client,
-- 
2.56.0