[bluez/bluez] 13b14d: shared/bap: Use util_ltv_foreach to process metadata

[bluez/bluez] 13b14d: shared/bap: Use util_ltv_foreach to process metadata

[Tom Catshoek]

  Branch: refs/heads/master
  Home:   https://github.com/bluez/bluez
  Commit: 13b14db95089382701f54a46e6ef0120b69d4a62
      https://github.com/bluez/bluez/commit/13b14db95089382701f54a46e6ef0120b69d4a62
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-07-07 (Tue, 07 Jul 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Use util_ltv_foreach to process metadata

This makes use of util_ltv_foreach to process the metadata entries
instead of attempting to iterate over the entries manually which
probably only works with the exact same order as used by PTS.


  Commit: 9e9f0a370c591c126c39225f5f50b88915d11095
      https://github.com/bluez/bluez/commit/9e9f0a370c591c126c39225f5f50b88915d11095
  Author: Rahul Samana <rahul.samana@oss.qualcomm.com>
  Date:   2026-07-07 (Tue, 07 Jul 2026)

  Changed paths:
    M gobex/gobex.c

  Log Message:
  -----------
  gobex: Fix use-after-free when cancelling SRM PUT transfer

In SRM mode put_get_data() queues the next packet during encoding of
the current one, so transfer->req_id and pending_req->id can diverge.
When g_obex_cancel_transfer() cancels the queued packet from tx_queue,
cancel_complete() frees the transfer while pending_req still holds a
callback pointing to it. Its G_OBEX_DEFAULT_TIMEOUT (10s) then fires
on freed memory causing a SIGSEGV.

Fix by clearing pending_req->rsp_func if it belongs to the same
transfer being cancelled.


  Commit: 82af2beafc39510e2c4a439bf44faea711d6503f
      https://github.com/bluez/bluez/commit/82af2beafc39510e2c4a439bf44faea711d6503f
  Author: Tom Catshoek <tomcatshoek@zeelandnet.nl>
  Date:   2026-07-09 (Thu, 09 Jul 2026)

  Changed paths:
    M src/adapter.c

  Log Message:
  -----------
  adapter: Fix crash on UUID discovery filter match

is_filter_match() looks up each discovery-filter UUID in the queue of
services parsed from a device advertisement. When that services list was
migrated from a GSList to a struct queue, the queue_find() call kept
GLib's g_slist_find_custom() argument order, passing the UUID string
where queue_find() expects a match function and the comparison function
where it expects the match data.

As a result queue_find() calls the UUID string as if it were a function,
jumping into non-executable heap and crashing bluetoothd with SIGSEGV as
soon as an advertisement matches a UUID filter configured via
SetDiscoveryFilter.

Add a queue_match_func_t helper and pass the arguments in the correct
order.

Fixes: https://github.com/bluez/bluez/issues/2282


Compare: https://github.com/bluez/bluez/compare/5c1c679ec304...82af2beafc39

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications