[PATCH BlueZ v2 4/5] shared/micp: Fix reading Mute State from an empty notification

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

micp_mute_state_notify copied one byte from the notification value
without checking its length, so a notification with no value made it
read past the value.

Pull the byte from the value instead and ignore the notification if it
is missing.

Fixes: 5c788b73 ("src/shared/micp.c: To implement MICP profile MICS service")
Assisted-by: OpenCode:claude-sonnet-5.5
---
 src/shared/micp.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/shared/micp.c b/src/shared/micp.c
index 98baff689fcc..7df8f8346f55 100644
--- a/src/shared/micp.c
+++ b/src/shared/micp.c
@@ -717,9 +717,16 @@ static void micp_mute_state_notify(struct bt_micp *micp, uint16_t value_handle,
 					const uint8_t *value, uint16_t length,
 					void *user_data)
 {
+	struct iovec iov = {
+		.iov_base = (void *)value,
+		.iov_len = length,
+	};
 	uint8_t mute_state;
 
-	memcpy(&mute_state, value, sizeof(mute_state));
+	if (!util_iov_pull_u8(&iov, &mute_state)) {
+		DBG(micp, "Unable to get Mute state");
+		return;
+	}
 
 	DBG(micp, "Mute state: 0x%x", mute_state);
 }
-- 
2.56.0