[PATCH BlueZ v1 10/10] shared/att: Fix signature length subtracted once per handler

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

handle_notify verified the signature and subtracted its length from
pdu_len inside the loop over the registered handlers, so with more than
one handler for a Signed Write Command the later handlers were passed a
truncated PDU and the signature was verified against it again.

Verify the signature and strip it only once.

Fixes: 051a525c ("shared/att.c: Add server signing key support")
Assisted-by: OpenCode:claude-sonnet-5.5
---
 src/shared/att.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/shared/att.c b/src/shared/att.c
index d1930f6af1d1..98e6e23eca82 100644
--- a/src/shared/att.c
+++ b/src/shared/att.c
@@ -1028,6 +1028,7 @@ static void handle_notify(struct bt_att_chan *chan, uint8_t *pdu,
 	struct bt_att *att = chan->att;
 	const struct queue_entry *entry;
 	bool found;
+	bool verified = false;
 	uint8_t opcode = pdu[0];
 
 	bt_att_ref(att);
@@ -1043,12 +1044,15 @@ static void handle_notify(struct bt_att_chan *chan, uint8_t *pdu,
 		if (!opcode_match(notify->opcode, opcode))
 			continue;
 
-		if ((opcode & ATT_OP_SIGNED_MASK) && att->crypto) {
+		if ((opcode & ATT_OP_SIGNED_MASK) && att->crypto && !verified) {
 			if (!handle_signed(att, pdu, pdu_len)) {
 				bt_att_unref(att);
 				return;
 			}
+
+			/* Verify and strip the signature only once */
 			pdu_len -= BT_ATT_SIGNATURE_LEN;
+			verified = true;
 		}
 
 		/* BLUETOOTH CORE SPECIFICATION Version 5.1 | Vol 3, Part G
-- 
2.56.0