[bluez/bluez] 36962e: gatt-client: fix use-after-free

[bluez/bluez] 36962e: gatt-client: fix use-after-free

[dalegaard]

  Branch: refs/heads/1039830
  Home:   https://github.com/bluez/bluez
  Commit: 36962eb519785db34582aeaca7b86de06c7151c1
      https://github.com/bluez/bluez/commit/36962eb519785db34582aeaca7b86de06c7151c1
  Author: Lasse Dalegaard <dalegaard@gmail.com>
  Date:   2026-01-08 (Thu, 08 Jan 2026)

  Changed paths:
    M src/gatt-client.c

  Log Message:
  -----------
  gatt-client: fix use-after-free

Clients with an acquired characteristic subscription would free the
client during disconnect. When notify_io_destroy then tries to remove
the client, it'll use-after-free.

Add another reference when allocating the notify_io and unref it again
in notify_io_destroy.


  Commit: a1661374ddb955ea63ac5da6f0fa5c33d3ef6cf0
      https://github.com/bluez/bluez/commit/a1661374ddb955ea63ac5da6f0fa5c33d3ef6cf0
  Author: Lasse Dalegaard <dalegaard@gmail.com>
  Date:   2026-01-08 (Thu, 08 Jan 2026)

  Changed paths:
    M src/device.c

  Log Message:
  -----------
  device: fix memory leak

device_add_eir_uuids creates a list of added UUIDs, but it was never
freed.


Compare: https://github.com/bluez/bluez/compare/36962eb51978%5E...a1661374ddb9

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications