[bluez/bluez] 6df617: gatt-server: Check prepare write length before rea...

[bluez/bluez] 6df617: gatt-server: Check prepare write length before rea...

[Luiz Augusto von Dentz]

  Branch: refs/heads/1162311
  Home:   https://github.com/bluez/bluez
  Commit: 6df6172376328d933971ea97888ac49a3207b205
      https://github.com/bluez/bluez/commit/6df6172376328d933971ea97888ac49a3207b205
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-09-10 (Thu, 10 Sep 2026)

  Changed paths:
    M src/shared/gatt-server.c

  Log Message:
  -----------
  gatt-server: Check prepare write length before reallocating

append_prep_data() grew the buffer and copied the new fragment into it
before rejecting a total length above UINT16_MAX. On overflow the
allocation had already been enlarged and written while prep_data->length
was left at its previous value, desynchronising the buffer from its
tracked size.

Move the bound check ahead of the realloc() so an oversized prepare
write queue is rejected without touching the buffer.

Assisted-by: opencode:claude-opus-5


  Commit: 7c30470f5f5ade0156edfc1093b2a938c9367efc
      https://github.com/bluez/bluez/commit/7c30470f5f5ade0156edfc1093b2a938c9367efc
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-09-10 (Thu, 10 Sep 2026)

  Changed paths:
    M src/adapter.c
    M src/device.c
    M src/profile.c
    M src/profile.h

  Log Message:
  -----------
  adapter: Unify the A2DP admin allowlist UUID mapping

The allowlist enforcement added across the adapter, device and A2DP
layers ended up using three different UUIDs for the same two profiles:
adapter.c mapped both a2dp-source and a2dp-sink to ADVANCED_AUDIO_UUID
(0x110d), while device.c and a2dp.c mapped them to the local role UUIDs
0x110a and 0x110b. An allowlist containing only 0x110a therefore blocked
the a2dp-sink adapter probe outright, so the finer grained SEP checks in
a2dp.c never ran.

Add btd_profile_get_policy_uuid() as the single place resolving a
profile to the UUID of the local service it provides. btd_profile names
and remote_uuid describe the remote role, so the A2DP profiles are
inverted there: "a2dp-source" registers the local Sink server and
"a2dp-sink" registers the local Source server. This matches what
device.c and a2dp.c already do.

Note that allowlisting 0x110d alone no longer enables A2DP; the local
role UUIDs 0x110a and/or 0x110b have to be listed.

This also drops the hardcoded profile name table in adapter.c. Every
entry but the two A2DP ones just returned profile->remote_uuid, and any
profile without a local_uuid that was missing from the table resolved to
NULL, i.e. was allowed unconditionally regardless of the allowlist.

Assisted-by: opencode:claude-opus-5


  Commit: f92e323272d0df5870d9fbec86e6ce0d25f76dc9
      https://github.com/bluez/bluez/commit/f92e323272d0df5870d9fbec86e6ce0d25f76dc9
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-09-10 (Thu, 10 Sep 2026)

  Changed paths:
    M src/battery.c
    M src/battery.h

  Log Message:
  -----------
  battery: Document the unknown sentinels and fix a stale name

btd_battery_update() treats UINT8_MAX and btd_battery_update_charging()
treats -1 as "unknown", invalidating the D-Bus property rather than
setting it. Neither was documented at the prototypes.

Also rename unregister_if_path_has_prefix() to
unregister_if_provider_matches(); it no longer compares path prefixes,
it compares the owning provider.

Assisted-by: opencode:claude-opus-5


  Commit: 9ddfe4d82a4fc4354f02ac6dcd578eb9016a1158
      https://github.com/bluez/bluez/commit/9ddfe4d82a4fc4354f02ac6dcd578eb9016a1158
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-09-10 (Thu, 10 Sep 2026)

  Changed paths:
    M Makefile.tools
    M client/admin.c
    M client/admin.h
    M client/main.c
    A client/main.h

  Log Message:
  -----------
  client/bluetoothctl: Declare the controller helper in its own header

bluetoothctl_get_default_controller() is implemented in main.c but was
declared in admin.h, the header of one of the submenus that consumes it.
Move the declaration to a new client/main.h so main.c also sees it.

While at it, drop the bluetooth/bluetooth.h include added to admin.c,
which is unused.

Assisted-by: opencode:claude-opus-5


Compare: https://github.com/bluez/bluez/compare/6df617237632%5E...9ddfe4d82a4f

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications