[bluez/bluez] 3e4758: audio/avrcp: Fix crash with invalid UTF-8 item name

[bluez/bluez] 3e4758: audio/avrcp: Fix crash with invalid UTF-8 item name

[fdanis-oss]

  Branch: refs/heads/979696
  Home:   https://github.com/bluez/bluez
  Commit: 3e47583cfde84035d0464acc965889cb085f06e5
      https://github.com/bluez/bluez/commit/3e47583cfde84035d0464acc965889cb085f06e5
  Author: Frédéric Danis <frederic.danis@collabora.com>
  Date:   2025-07-07 (Mon, 07 Jul 2025)

  Changed paths:
    M profiles/audio/avrcp.c

  Log Message:
  -----------
  audio/avrcp: Fix crash with invalid UTF-8 item name

As stated in AVRCP 1.6.2 chapter 6.10.2.3 Media element item, for the
Displayable Name Length property, the target device may truncate the
item name:

  Length of Displayable Name in octets. The name shall be limited such
  that a response to a GetFolderItems containing one media player item
  fits within the maximum size of PDU which can be received by the CT.

This truncatation may occur in the middle of a multi-byte character,
at least with Samsung Music app, which triggers a DBus assertion and
crashes bluetoothd:

  profiles/audio/player.c:media_folder_create_item() Din Dhal Jaye
      Haye with lyrics | "दिन ढल जाए
      हाय" गाने के बो� type audio uid 1
  profiles/audio/player.c:media_folder_create_item()
      /org/bluez/hci0/dev_24_24_B7_11_82_6C/player0/NowPlaying/item1
  profiles/audio/player.c:media_player_set_metadata() Title: Din Dhal
      Jaye Haye with lyrics | "दिन ढल जाए हाय"
      गाने के बोल | Guide | Dev Anand, Waheeda Rehman
  …
  arguments to dbus_message_iter_append_basic() were incorrect,
      assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in
      file dbus-message.c line 2775.
  This is normally a bug in some application using the D-Bus library.



To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications