[PATCH BlueZ v1 06/10] shared/gatt-server: Fix authorize callback getting handle 0 on write

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

write_cb called authorize_req before decoding the handle from the PDU,
so the authorize callback always saw handle 0 for Write Request, Write
Command and Signed Write Command.

Decode the handle first and add a test checking the handle that is
passed to the callback.

Fixes: 291e9a0d8e6e ("shared/gatt-server: Add bt_gatt_server_set_authorize")
Assisted-by: OpenCode:claude-sonnet-5.5
---
 src/shared/gatt-server.c |  4 +---
 unit/test-gatt.c         | 39 ++++++++++++++++++++++++++++++++++++++-
 2 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 6796817bf324..b63745c4df2e 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -838,7 +838,7 @@ static void write_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 	struct async_write_op *op = NULL;
 	uint8_t ecode;
 
-	if (iov.iov_len < sizeof(handle)) {
+	if (!util_iov_pull_le16(&iov, &handle)) {
 		ecode = BT_ATT_ERROR_INVALID_PDU;
 		goto error;
 	}
@@ -847,8 +847,6 @@ static void write_cb(struct bt_att_chan *chan, uint16_t mtu, uint8_t opcode,
 	if (ecode)
 		goto error;
 
-	util_iov_pull_le16(&iov, &handle);
-
 	attr = gatt_db_get_attribute(server->db, handle);
 	if (!attr) {
 		ecode = BT_ATT_ERROR_INVALID_HANDLE;
diff --git a/unit/test-gatt.c b/unit/test-gatt.c
index ad8e95453be2..bf60741077c5 100644
--- a/unit/test-gatt.c
+++ b/unit/test-gatt.c
@@ -2008,7 +2008,7 @@ static void test_client(gconstpointer data)
 	create_context(512, data);
 }
 
-static void test_server(gconstpointer data)
+static struct context *create_server_context(gconstpointer data)
 {
 	struct context *context = create_context(512, data);
 	ssize_t len;
@@ -2021,8 +2021,38 @@ static void test_server(gconstpointer data)
 	tester_monitor('<', 0x0004, 0x0000, pdu.data, len);
 
 	g_free(pdu.data);
+
+	return context;
+}
+
+static void test_server(gconstpointer data)
+{
+	create_server_context(data);
 }
 
+static uint8_t server_authorize_cb(struct bt_att *att, uint8_t opcode,
+					uint16_t handle, void *user_data)
+{
+	struct context *context = user_data;
+	const struct test_step *step = context->data->step;
+
+	g_assert_cmpint(handle, ==, step->handle);
+
+	return 0;
+}
+
+static void test_server_authorize(gconstpointer data)
+{
+	struct context *context = create_server_context(data);
+
+	g_assert(bt_gatt_server_set_authorize(context->server,
+						server_authorize_cb, context));
+}
+
+static const struct test_step test_server_authorize_1 = {
+	.handle = 0x0004,
+};
+
 static void test_search_primary(gconstpointer data)
 {
 	struct context *context = create_context(512, data);
@@ -5038,6 +5068,13 @@ int main(int argc, char *argv[])
 			raw_pdu(0x23, 0x03, 0x00, 0x09, 0x00, 0x01, 0x02,
 				0x03));
 
+	define_test_server("/robustness/write-authorize-handle",
+			test_server_authorize, ts_small_db,
+			&test_server_authorize_1,
+			raw_pdu(0x03, 0x00, 0x02),
+			raw_pdu(0x12, 0x04, 0x00, 0x01, 0x00),
+			raw_pdu(0x13));
+
 	define_test_server("/robustness/read-by-grp-type-malformed",
 			test_server, ts_small_db, NULL,
 			raw_pdu(0x03, 0x00, 0x02),
-- 
2.56.0