[bluez/bluez] cf18b0: shared/mcp: fix crash on destroy after ATT gone

[bluez/bluez] cf18b0: shared/mcp: fix crash on destroy after ATT gone

[Pauli Virtanen]

  Branch: refs/heads/1077651
  Home:   https://github.com/bluez/bluez
  Commit: cf18b01149155f7cd2294ceeb79b338cff778fbd
      https://github.com/bluez/bluez/commit/cf18b01149155f7cd2294ceeb79b338cff778fbd
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-04-06 (Mon, 06 Apr 2026)

  Changed paths:
    M src/shared/mcp.c

  Log Message:
  -----------
  shared/mcp: fix crash on destroy after ATT gone

Tie lifetime of bt_mcs_session to that of ATT disconnect watch.  The
disconnect handler is not necessarily called before ATT is freed, but
destroy is.

Fixes UAF of session->att in bt_mcs_unregister() -> session_destroy() ->
bt_att_unregister_disconnect() if ATT was freed first.


  Commit: 39d78e7712d5e1ce5f1071776ae0a445802f3244
      https://github.com/bluez/bluez/commit/39d78e7712d5e1ce5f1071776ae0a445802f3244
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-04-06 (Mon, 06 Apr 2026)

  Changed paths:
    M src/shared/mcp.c
    M unit/test-mcp.c

  Log Message:
  -----------
  shared/mcp: fix parsing of control point arguments

Fix parsing of control point argument lost in rebases.

Add tests for Move Relative command that need it:

MCS/SR/MCP/BV-12-C [Move Relative from Playing]
MCS/SR/MCP/BV-13-C [Move Relative from Paused]
MCS/SR/MCP/BV-14-C [Move Relative from Seeking]
MCS/SR/MCP/BV-75-C [Move Relative from Inactive]


Compare: https://github.com/bluez/bluez/compare/cf18b0114915%5E...39d78e7712d5

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications