audio/avrcp: Fix crash with invalid UTF-8 item name

index 5d3a14d96..5262458cb 100644
@@ -1959,3 +1959,45 @@ bool argsisutf8(int argc, char *argv[])
 
 	return true;
 }
+
+char *strtoutf8(char *str, size_t len)
+{
+	size_t i = 0;
+
+	while (i < len) {
+		unsigned char c = str[i];
+		size_t size = 0;
+
+		/* Check the first byte to determine the number of bytes in the
+		 * UTF-8 character.
+		 */
+		if ((c & 0x80) == 0x00)
+			size = 1;
+		else if ((c & 0xE0) == 0xC0)
+			size = 2;
+		else if ((c & 0xF0) == 0xE0)
+			size = 3;
+		else if ((c & 0xF8) == 0xF0)
+			size = 4;
+		else
+			/* Invalid UTF-8 sequence */
+			goto done;
+
+		/* Check the following bytes to ensure they have the correct
+		 * format.
+		 */
+		for (size_t j = 1; j < size; ++j) {
+			if (i + j > len || (str[i + j] & 0xC0) != 0x80)
+				/* Invalid UTF-8 sequence */
+				goto done;
+		}
+
+		/* Move to the next character */
+		i += size;
+	}
+
+done:
+	/* Truncate to the longest valid UTF-8 string */
+	memset(str + i, 0, len - i);
+	return str;
+}

index dd357fb93..6fc02a9dc 100644
@@ -92,6 +92,7 @@ int strsuffix(const char *str, const char *suffix);
 char *strstrip(char *str);
 bool strisutf8(const char *str, size_t length);
 bool argsisutf8(int argc, char *argv[]);
+char *strtoutf8(char *str, size_t len);
 
 void *util_malloc(size_t size);
 void *util_memdup(const void *src, size_t size);

index 831f1dc8b..30997335a 100644
@@ -2595,8 +2595,10 @@ static struct media_item *parse_media_element(struct avrcp *session,
 	memset(name, 0, sizeof(name));
 	namesize = get_be16(&operands[11]);
 	namelen = MIN(namesize, sizeof(name) - 1);
-	if (namelen > 0)
+	if (namelen > 0) {
 		memcpy(name, &operands[13], namelen);
+		strtoutf8(name, namelen);
+	}
 
 	count = operands[13 + namesize];
 

index d3ccb97c5..5fe7ef82a 100644
@@ -72,21 +72,12 @@ static void mcp_debug(const char *str, void *user_data)
 static char *name2utf8(const uint8_t *name, uint16_t len)
 {
 	char utf8_name[HCI_MAX_NAME_LENGTH + 2];
-	int i;
-
-	if (g_utf8_validate((const char *) name, len, NULL))
-		return g_strndup((char *) name, len);
 
 	len = MIN(len, sizeof(utf8_name) - 1);
 
 	memset(utf8_name, 0, sizeof(utf8_name));
 	strncpy(utf8_name, (char *) name, len);
-
-	/* Assume ASCII, and replace all non-ASCII with spaces */
-	for (i = 0; utf8_name[i] != '\0'; i++) {
-		if (!isascii(utf8_name[i]))
-			utf8_name[i] = ' ';
-	}
+	strtoutf8(utf8_name, len);
 
 	/* Remove leading and trailing whitespace characters */
 	g_strstrip(utf8_name);

index 08aaf19cb..74dabf41f 100644
@@ -69,21 +69,12 @@ static void gas_free(struct gas *gas)
 static char *name2utf8(const uint8_t *name, uint16_t len)
 {
 	char utf8_name[HCI_MAX_NAME_LENGTH + 2];
-	int i;
-
-	if (g_utf8_validate((const char *) name, len, NULL))
-		return g_strndup((char *) name, len);
 
 	len = MIN(len, sizeof(utf8_name) - 1);
 
 	memset(utf8_name, 0, sizeof(utf8_name));
 	strncpy(utf8_name, (char *) name, len);
-
-	/* Assume ASCII, and replace all non-ASCII with spaces */
-	for (i = 0; utf8_name[i] != '\0'; i++) {
-		if (!isascii(utf8_name[i]))
-			utf8_name[i] = ' ';
-	}
+	strtoutf8(utf8_name, len);
 
 	/* Remove leading and trailing whitespace characters */
 	g_strstrip(utf8_name);

index 28b09653c..1e1f76952 100644
@@ -127,19 +127,10 @@ static void eir_parse_uuid128(struct eir_data *eir, const uint8_t *data,
 static char *name2utf8(const uint8_t *name, uint8_t len)
 {
 	char utf8_name[HCI_MAX_NAME_LENGTH + 2];
-	int i;
-
-	if (g_utf8_validate((const char *) name, len, NULL))
-		return g_strndup((char *) name, len);
 
 	memset(utf8_name, 0, sizeof(utf8_name));
 	strncpy(utf8_name, (char *) name, len);
-
-	/* Assume ASCII, and replace all non-ASCII with spaces */
-	for (i = 0; utf8_name[i] != '\0'; i++) {
-		if (!isascii(utf8_name[i]))
-			utf8_name[i] = ' ';
-	}
+	strtoutf8(utf8_name, len);
 
 	/* Remove leading and trailing whitespace characters */
 	g_strstrip(utf8_name);

index 3f0064dd9..6952a0dab 100644
@@ -276,7 +276,6 @@ static bool ad_replace_uuid128(struct bt_ad *ad, struct iovec *iov)
 static bool ad_replace_name(struct bt_ad *ad, struct iovec *iov)
 {
 	char utf8_name[HCI_MAX_NAME_LENGTH + 2];
-	int i;
 
 	memset(utf8_name, 0, sizeof(utf8_name));
 	strncpy(utf8_name, (const char *)iov->iov_base, iov->iov_len);

@@ -284,11 +283,7 @@ static bool ad_replace_name(struct bt_ad *ad, struct iovec *iov)
 	if (strisutf8(utf8_name, iov->iov_len))
 		goto done;
 
-	/* Assume ASCII, and replace all non-ASCII with spaces */
-	for (i = 0; utf8_name[i] != '\0'; i++) {
-		if (!isascii(utf8_name[i]))
-			utf8_name[i] = ' ';
-	}
+	strtoutf8(utf8_name, iov->iov_len);
 
 	/* Remove leading and trailing whitespace characters */
 	strstrip(utf8_name);

index 4780f26b6d59..9ba1bdc48f77 100644
@@ -1987,7 +1987,7 @@ char *strtoutf8(char *str, size_t len)
                 * format.
                 */
                for (size_t j = 1; j < size; ++j) {
-                       if (i + j > len || (str[i + j] & 0xC0) != 0x80)
+                       if (i + j >= len || (str[i + j] & 0xC0) != 0x80)
                                /* Invalid UTF-8 sequence */
                                goto done;
                }

index 49ce65f24..b94a2985a 100644
@@ -396,6 +396,50 @@ static const struct test_data fuelband_test = {
 	.uuid = fuelband_uuid,
 };
 
+static const unsigned char invalid_utf8_name_data[] = {
+		0x22, 0x09, 0x74, 0x65, 0x73, 0x74, 0x20, 0xe0,
+		0xa4, 0xaa, 0xe0, 0xa4, 0xb0, 0xe0, 0xa5, 0x80,
+		0xe0, 0xa4, /*0x95,*/ 0xe0, 0xa5, 0x8d, 0xe0, 0xa4,
+		0xb7, 0xe0, 0xa4, 0xbe, 0x20, 0x69, 0x6e, 0x76,
+		0x61, 0x6c, 0x69, 0x64,
+};
+
+static const struct test_data invalid_utf8_name_test = {
+	.eir_data = invalid_utf8_name_data,
+	.eir_size = sizeof(invalid_utf8_name_data),
+	.name = "test परी",
+	.name_complete = true,
+	.tx_power = 127,
+};
+
+static const unsigned char utf16_name_data[] = {
+		0x17, 0x09, 0x00, 0x55, 0x00, 0x54, 0x00, 0x46,
+		0x00, 0x2d, 0x00, 0x31, 0x00, 0x36, 0x00, 0x20,
+		0x00, 0x74, 0x00, 0x65, 0x00, 0x73, 0x00, 0x74,
+};
+
+static const struct test_data utf16_name_test = {
+	.eir_data = utf16_name_data,
+	.eir_size = sizeof(utf16_name_data),
+	.name = "",
+	.name_complete = true,
+	.tx_power = 127,
+};
+
+static const unsigned char iso_2022_jp_name_data[] = {
+		0x13, 0x09, 0x74, 0x65, 0x73, 0x74, 0x20, 0x1B,
+		0x24, 0x42, 0xbb, 0xfa, 0xb8, 0xb5, 0x1b, 0x28,
+		0x42, 0x20, 0x4f, 0x4b,
+};
+
+static const struct test_data iso_2022_jp_name_test = {
+	.eir_data = iso_2022_jp_name_data,
+	.eir_size = sizeof(iso_2022_jp_name_data),
+	.name = "test \033$B",
+	.name_complete = true,
+	.tx_power = 127,
+};
+
 static const unsigned char bluesc_data[] = {
 		0x02, 0x01, 0x06, 0x03, 0x02, 0x16, 0x18, 0x12,
 		0x09, 0x57, 0x61, 0x68, 0x6f, 0x6f, 0x20, 0x42,

@@ -707,6 +751,12 @@ int main(int argc, char *argv[])
 	tester_add("/eir/sl910", &gigaset_sl910_test, NULL, test_parsing, NULL);
 	tester_add("/eir/bh907", &nokia_bh907_test, NULL, test_parsing, NULL);
 	tester_add("/eir/fuelband", &fuelband_test, NULL, test_parsing, NULL);
+	tester_add("/eir/invalid-utf8-name", &invalid_utf8_name_test, NULL,
+							test_parsing, NULL);
+	tester_add("/eir/utf16-name", &utf16_name_test, NULL, test_parsing,
+									NULL);
+	tester_add("/eir/iso-2022-jp-name", &iso_2022_jp_name_test, NULL,
+							test_parsing, NULL);
 	tester_add("/ad/bluesc", &bluesc_test, NULL, test_parsing, NULL);
 	tester_add("/ad/wahooscale", &wahoo_scale_test, NULL, test_parsing,
 									NULL);