[bluez/bluez] 27a4c4: bass: Fix possible crash on bass_update_bis_sync

[bluez/bluez] 27a4c4: bass: Fix possible crash on bass_update_bis_sync

[Matthew]

  Branch: refs/heads/master
  Home:   https://github.com/bluez/bluez
  Commit: 27a4c48b048113576925adad4477aee02c8119b6
      https://github.com/bluez/bluez/commit/27a4c48b048113576925adad4477aee02c8119b6
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M profiles/audio/bass.c

  Log Message:
  -----------
  bass: Fix possible crash on bass_update_bis_sync

bass_update_bis_sync does use bass_remove_bis which may end up
removing the current entry causing a crash on entry->next, to avoid
that prefetch the next entry.


  Commit: 2262e371564994b429b045cdd34f53eee0cd0c13
      https://github.com/bluez/bluez/commit/2262e371564994b429b045cdd34f53eee0cd0c13
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Check if stream is valid before attempting to release

bt_bap_stream_release shall check if the stream is still valid before
attempting to release it just as done with other operations.


  Commit: c0fec57e9fa28692dc36e12616c5b74e4fa425ec
      https://github.com/bluez/bluez/commit/c0fec57e9fa28692dc36e12616c5b74e4fa425ec
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Don't transition to IDLE inside bap_bcast_set_state

Remove the recursive stream_set_state(IDLE) call from the RELEASING
case in bap_bcast_set_state. This call re-entered bap_bcast_set_state
while the state_cbs queue was still being iterated, causing a
use-after-free if a callback unregistered itself during notification.


  Commit: a9b6c8a2ea624a62101df16dde5735f4bde1631b
      https://github.com/bluez/bluez/commit/a9b6c8a2ea624a62101df16dde5735f4bde1631b
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Use queue_foreach to notify state changes

Use queue_foreach to notify state changes since that is considered
safer as it does attempt to detect list modification while traversing
the list.


  Commit: a2c7bc03b75969f784d1ea1feacc78773063025c
      https://github.com/bluez/bluez/commit/a2c7bc03b75969f784d1ea1feacc78773063025c
  Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M src/shared/bap.c

  Log Message:
  -----------
  shared/bap: Protect bap_stream_notify_connecting

bap_stream_notify_connecting may encounter callbacks that remove itself
while traversing the state_cbs, so this attempts to prevent to cause a
crash by prefetching the next entry.


  Commit: 220f102c8db9888bd113d0d53cd246ece3012696
      https://github.com/bluez/bluez/commit/220f102c8db9888bd113d0d53cd246ece3012696
  Author: Matthew Cash <matthew@matthew-cash.com>
  Date:   2026-06-29 (Mon, 29 Jun 2026)

  Changed paths:
    M profiles/midi/libmidi.c
    M profiles/midi/libmidi.h

  Log Message:
  -----------
  profiles/midi: Fix zero timestampHigh

BLE-MIDI timestampHigh can legitimately be zero. The MIDI parser used
timestamp_high == 0 to decide whether it had already consumed the packet
header, so packets starting with 0x80 0x80 caused the next running-status
payload byte to be consumed as another timestamp header.

Track whether timestampHigh has been read separately from its value so
packed MIDI events with zero timestampHigh are parsed correctly.


Compare: https://github.com/bluez/bluez/compare/eb9b35c8d13d...220f102c8db9

To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications