[bluez/bluez] 758541: profiles/audio: fix UAF on external media service ...

[bluez/bluez] 758541: profiles/audio: fix UAF on external media service ...

[fdanis-oss]

  Branch: refs/heads/1128272
  Home:   https://github.com/bluez/bluez
  Commit: 75854126b5d17c81e1fc127ca2914711a0b60004
      https://github.com/bluez/bluez/commit/75854126b5d17c81e1fc127ca2914711a0b60004
  Author: Frédéric Danis <frederic.danis@collabora.com>
  Date:   2026-07-15 (Wed, 15 Jul 2026)

  Changed paths:
    M profiles/audio/media.c

  Log Message:
  -----------
  profiles/audio: fix UAF on external media service teardown

Keep media_app endpoint/player queues in sync with object lifetime to
avoid stale pointers during proxy removal.

When admin allowlist reapply removes audio services, endpoint/player
objects may be destroyed through non-proxy paths first.
Later proxy_removed_cb calls queue_remove_if() and matching by path
can dereference freed endpoint/player memory.

Fix by:
- adding media_app back-references in media_endpoint/local_player
- unlinking from app queues inside media_endpoint_remove or
  local_player_remove
- setting ownership when app-registering endpoint/player objects

This prevents heap-use-after-free in match_endpoint_by_path or
match_player_by_path during service disconnect.

Assisted-by: GPT:GPT-5.3-Codex



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications