[bluez/bluez] 5a7a91: shared/mcp: fix crash on destroy after ATT gone

[bluez/bluez] 5a7a91: shared/mcp: fix crash on destroy after ATT gone

[Pauli Virtanen]

  Branch: refs/heads/1077654
  Home:   https://github.com/bluez/bluez
  Commit: 5a7a91116c9d6b1d9cab858b9d198ac3ff2fe329
      https://github.com/bluez/bluez/commit/5a7a91116c9d6b1d9cab858b9d198ac3ff2fe329
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-04-06 (Mon, 06 Apr 2026)

  Changed paths:
    M src/shared/mcp.c

  Log Message:
  -----------
  shared/mcp: fix crash on destroy after ATT gone

Tie lifetime of bt_mcs_session to that of ATT disconnect watch.  The
disconnect handler is not necessarily called before ATT is freed, but
destroy is.

Fixes UAF of session->att in bt_mcs_unregister() -> session_destroy() ->
bt_att_unregister_disconnect() if ATT was freed first.


  Commit: 6a643eb08d1ccb622f847683e739aa242f2ef359
      https://github.com/bluez/bluez/commit/6a643eb08d1ccb622f847683e739aa242f2ef359
  Author: Pauli Virtanen <pav@iki.fi>
  Date:   2026-04-06 (Mon, 06 Apr 2026)

  Changed paths:
    M src/shared/mcp.c
    M unit/test-mcp.c

  Log Message:
  -----------
  shared/mcp: fix parsing of control point arguments

Fix parsing of control point argument lost in rebases.

Add tests for Move Relative command that need it:

MCS/SR/MCP/BV-12-C [Move Relative from Playing]
MCS/SR/MCP/BV-13-C [Move Relative from Paused]
MCS/SR/MCP/BV-14-C [Move Relative from Seeking]
MCS/SR/MCP/BV-75-C [Move Relative from Inactive]


Compare: https://github.com/bluez/bluez/compare/5a7a91116c9d%5E...6a643eb08d1c

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications