Re: [PATCH BlueZ v2 0/5] audio/avrcp: Fix crash with invalid UTF-8 item name

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Bastien, Frederic,

On Tue, Jul 8, 2025 at 4:05 AM Bastien Nocera <hadess@xxxxxxxxxx> wrote:
>
> On Tue, 2025-07-08 at 09:08 +0200, Frédéric Danis wrote:
> > As stated in AVRCP 1.6.2 chapter 6.10.2.3 Media element item, for the
> > Displayable Name Length property, the target device may truncate the
> > item name:
> >
> >   Length of Displayable Name in octets. The name shall be limited
> > such
> >   that a response to a GetFolderItems containing one media player
> > item
> >   fits within the maximum size of PDU which can be received by the
> > CT.
> >
> > This truncatation may occur in the middle of a multi-byte character,
> > at least with Samsung Music app, which triggers a DBus assertion and
> > crashes bluetoothd:
> >
> >   profiles/audio/player.c:media_folder_create_item() Din Dhal Jaye
> >       Haye with lyrics | "दिन ढल जाए
> >       हाय" गाने के बो� type audio uid 1
> >   profiles/audio/player.c:media_folder_create_item()
> >       /org/bluez/hci0/dev_24_24_B7_11_82_6C/player0/NowPlaying/item1
> >   profiles/audio/player.c:media_player_set_metadata() Title: Din Dhal
> >       Jaye Haye with lyrics | "दिन ढल जाए हाय"
> >       गाने के बोल | Guide | Dev Anand, Waheeda Rehman
> >   …
> >   arguments to dbus_message_iter_append_basic() were incorrect,
> >       assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in
> >       file dbus-message.c line 2775.
> >   This is normally a bug in some application using the D-Bus library.
> >
> > v1->v2:
> >   - Introduce new strtoutf8() util function to truncate a string
> > before
> >     the first non UTF-8 character.
> >   - Use strtoutf8() for AVRCP media element name
> >   - Use strtoutf8() for MCP player name and track title
> >   - Use strtoutf8() for Audio GAP device name
> >   - Use strtoutf8() for EIR device names
>
> Would be great to have a test case for that new function, with a bunch
> of the problems you ran into tested for.

Yep, we do have the likes of test-eir where we can add tests with
names for the devices, we probably want to try with strings where
there are invalid UTF-8 and also using other things like UTF16 and
other string formats to check that it doesn't crash at least.

> >
> > Frédéric Danis (5):
> >   shared/util: Add strtoutf8 function
> >   audio/avrcp: Fix crash with invalid UTF-8 item name
> >   audio/mcp: Use strtoutf8 for player name and track title
> >   audio/gap: Use strtoutf8 for GAP device name
> >   eir: Use strtoutf8 for device names
> >
> >  profiles/audio/avrcp.c |  4 +++-
> >  profiles/audio/mcp.c   | 11 +----------
> >  profiles/gap/gas.c     | 11 +----------
> >  src/eir.c              | 11 +----------
> >  src/shared/util.c      | 42
> > ++++++++++++++++++++++++++++++++++++++++++
> >  src/shared/util.h      |  1 +
> >  6 files changed, 49 insertions(+), 31 deletions(-)
>


-- 
Luiz Augusto von Dentz





[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux