public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH BlueZ v2 0/5] audio/avrcp: Fix crash with invalid UTF-8 item name
@ 2025-07-08  7:08 Frédéric Danis
  2025-07-08  7:08 ` [PATCH BlueZ v2 1/5] shared/util: Add strtoutf8 function Frédéric Danis
                   ` (5 more replies)
  0 siblings, 6 replies; 11+ messages in thread
From: Frédéric Danis @ 2025-07-08  7:08 UTC (permalink / raw)
  To: linux-bluetooth

As stated in AVRCP 1.6.2 chapter 6.10.2.3 Media element item, for the
Displayable Name Length property, the target device may truncate the
item name:

  Length of Displayable Name in octets. The name shall be limited such
  that a response to a GetFolderItems containing one media player item
  fits within the maximum size of PDU which can be received by the CT.

This truncatation may occur in the middle of a multi-byte character,
at least with Samsung Music app, which triggers a DBus assertion and
crashes bluetoothd:

  profiles/audio/player.c:media_folder_create_item() Din Dhal Jaye
      Haye with lyrics | "दिन ढल जाए
      हाय" गाने के बो� type audio uid 1
  profiles/audio/player.c:media_folder_create_item()
      /org/bluez/hci0/dev_24_24_B7_11_82_6C/player0/NowPlaying/item1
  profiles/audio/player.c:media_player_set_metadata() Title: Din Dhal
      Jaye Haye with lyrics | "दिन ढल जाए हाय"
      गाने के बोल | Guide | Dev Anand, Waheeda Rehman
  …
  arguments to dbus_message_iter_append_basic() were incorrect,
      assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in
      file dbus-message.c line 2775.
  This is normally a bug in some application using the D-Bus library.

v1->v2:
  - Introduce new strtoutf8() util function to truncate a string before
    the first non UTF-8 character.
  - Use strtoutf8() for AVRCP media element name
  - Use strtoutf8() for MCP player name and track title
  - Use strtoutf8() for Audio GAP device name
  - Use strtoutf8() for EIR device names

Frédéric Danis (5):
  shared/util: Add strtoutf8 function
  audio/avrcp: Fix crash with invalid UTF-8 item name
  audio/mcp: Use strtoutf8 for player name and track title
  audio/gap: Use strtoutf8 for GAP device name
  eir: Use strtoutf8 for device names

 profiles/audio/avrcp.c |  4 +++-
 profiles/audio/mcp.c   | 11 +----------
 profiles/gap/gas.c     | 11 +----------
 src/eir.c              | 11 +----------
 src/shared/util.c      | 42 ++++++++++++++++++++++++++++++++++++++++++
 src/shared/util.h      |  1 +
 6 files changed, 49 insertions(+), 31 deletions(-)

-- 
2.43.0


^ permalink raw reply	[flat|nested] 11+ messages in thread
* [PATCH BlueZ v3 1/7] shared/util: Add strtoutf8 function
@ 2025-07-08 15:43 Frédéric Danis
  2025-07-08 17:06 ` audio/avrcp: Fix crash with invalid UTF-8 item name bluez.test.bot
  0 siblings, 1 reply; 11+ messages in thread
From: Frédéric Danis @ 2025-07-08 15:43 UTC (permalink / raw)
  To: linux-bluetooth

This adds the strtoutf8 function that truncate a string before the
first non UTF-8 character.
This truncation is done in place.
---
 src/shared/util.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 src/shared/util.h |  1 +
 2 files changed, 43 insertions(+)

diff --git a/src/shared/util.c b/src/shared/util.c
index 5d3a14d96..5262458cb 100644
--- a/src/shared/util.c
+++ b/src/shared/util.c
@@ -1959,3 +1959,45 @@ bool argsisutf8(int argc, char *argv[])
 
 	return true;
 }
+
+char *strtoutf8(char *str, size_t len)
+{
+	size_t i = 0;
+
+	while (i < len) {
+		unsigned char c = str[i];
+		size_t size = 0;
+
+		/* Check the first byte to determine the number of bytes in the
+		 * UTF-8 character.
+		 */
+		if ((c & 0x80) == 0x00)
+			size = 1;
+		else if ((c & 0xE0) == 0xC0)
+			size = 2;
+		else if ((c & 0xF0) == 0xE0)
+			size = 3;
+		else if ((c & 0xF8) == 0xF0)
+			size = 4;
+		else
+			/* Invalid UTF-8 sequence */
+			goto done;
+
+		/* Check the following bytes to ensure they have the correct
+		 * format.
+		 */
+		for (size_t j = 1; j < size; ++j) {
+			if (i + j > len || (str[i + j] & 0xC0) != 0x80)
+				/* Invalid UTF-8 sequence */
+				goto done;
+		}
+
+		/* Move to the next character */
+		i += size;
+	}
+
+done:
+	/* Truncate to the longest valid UTF-8 string */
+	memset(str + i, 0, len - i);
+	return str;
+}
diff --git a/src/shared/util.h b/src/shared/util.h
index dd357fb93..6fc02a9dc 100644
--- a/src/shared/util.h
+++ b/src/shared/util.h
@@ -92,6 +92,7 @@ int strsuffix(const char *str, const char *suffix);
 char *strstrip(char *str);
 bool strisutf8(const char *str, size_t length);
 bool argsisutf8(int argc, char *argv[]);
+char *strtoutf8(char *str, size_t len);
 
 void *util_malloc(size_t size);
 void *util_memdup(const void *src, size_t size);
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2025-07-08 17:06 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-08  7:08 [PATCH BlueZ v2 0/5] audio/avrcp: Fix crash with invalid UTF-8 item name Frédéric Danis
2025-07-08  7:08 ` [PATCH BlueZ v2 1/5] shared/util: Add strtoutf8 function Frédéric Danis
2025-07-08  8:32   ` audio/avrcp: Fix crash with invalid UTF-8 item name bluez.test.bot
2025-07-08 13:55   ` [PATCH BlueZ v2 1/5] shared/util: Add strtoutf8 function Luiz Augusto von Dentz
2025-07-08  7:08 ` [PATCH BlueZ v2 2/5] audio/avrcp: Fix crash with invalid UTF-8 item name Frédéric Danis
2025-07-08  7:08 ` [PATCH BlueZ v2 3/5] audio/mcp: Use strtoutf8 for player name and track title Frédéric Danis
2025-07-08  7:08 ` [PATCH BlueZ v2 4/5] audio/gap: Use strtoutf8 for GAP device name Frédéric Danis
2025-07-08  7:08 ` [PATCH BlueZ v2 5/5] eir: Use strtoutf8 for device names Frédéric Danis
2025-07-08  8:05 ` [PATCH BlueZ v2 0/5] audio/avrcp: Fix crash with invalid UTF-8 item name Bastien Nocera
2025-07-08 14:01   ` Luiz Augusto von Dentz
  -- strict thread matches above, loose matches on Subject: below --
2025-07-08 15:43 [PATCH BlueZ v3 1/7] shared/util: Add strtoutf8 function Frédéric Danis
2025-07-08 17:06 ` audio/avrcp: Fix crash with invalid UTF-8 item name bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox