audio/avrcp: Fix crash with invalid UTF-8 item name

This adds the strtoutf8 function that truncate a string before the first non UTF-8 character.
This truncation is done in place.

---
 src/shared/util.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 src/shared/util.h |  1 +
 2 files changed, 43 insertions(+)

src/shared/util.c +26 -0

index 5d3a14d96..5262458cb 100644
@@ -1959,3 +1959,45 @@ bool argsisutf8(int argc, char *argv[])
 
        return true;
 }
+
+char *strtoutf8(char *str, size_t len)
+{
+       size_t i = 0;
+
+       while (i < len) {
+               unsigned char c = str[i];
+               size_t size = 0;
+
+               /* Check the first byte to determine the number of bytes in the
+                * UTF-8 character.
+                */
+               if ((c & 0x80) == 0x00)
+                       size = 1;
+               else if ((c & 0xE0) == 0xC0)
+                       size = 2;
+               else if ((c & 0xF0) == 0xE0)
+                       size = 3;
+               else if ((c & 0xF8) == 0xF0)
+                       size = 4;
+               else
+                       /* Invalid UTF-8 sequence */
+                       goto done;
+
+               /* Check the following bytes to ensure they have the correct
+                * format.

src/shared/util.c +6 -0

+
+done:
+       /* Truncate to the longest valid UTF-8 string */
+       memset(str + i, 0, len - i);
+       return str;
+}

src/shared/util.h +1 -1

index dd357fb93..6fc02a9dc 100644
@@ -92,6 +92,7 @@ int strsuffix(const char *str, const char *suffix);
 char *strstrip(char *str);
 bool strisutf8(const char *str, size_t length);
 bool argsisutf8(int argc, char *argv[]);
+char *strtoutf8(char *str, size_t len);
 
 void *util_malloc(size_t size);
 void *util_memdup(const void *src, size_t size);
--

2.43.0

As stated in AVRCP 1.6.2 chapter 6.10.2.3 Media element item, for the Displayable Name Length property, the target device may truncate the item name:

  Length of Displayable Name in octets. The name shall be limited such
  that a response to a GetFolderItems containing one media player item
  fits within the maximum size of PDU which can be received by the CT.

This truncatation may occur in the middle of a multi-byte character, at least with Samsung Music app, which triggers a DBus assertion and crashes bluetoothd:

  profiles/audio/player.c:media_folder_create_item() Din Dhal Jaye Haye with lyrics | "दिन ढल जाए
      हाय" गाने के बो� type audio uid 1 profiles/audio/player.c:media_folder_create_item() /org/bluez/hci0/dev_24_24_B7_11_82_6C/player0/NowPlaying/item1 profiles/audio/player.c:media_player_set_metadata() Title: Din Dhal Jaye Haye with lyrics | "दिन ढल जाए हाय"
      गाने के बोल | Guide | Dev Anand, Waheeda Rehman
  …
  arguments to dbus_message_iter_append_basic() were incorrect, assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in file dbus-message.c line 2775.
  This is normally a bug in some application using the D-Bus library.

v1->v2:
  - Introduce new strtoutf8() util function to truncate a string before
    the first non UTF-8 character.
  - Use strtoutf8() for AVRCP media element name
  - Use strtoutf8() for MCP player name and track title
  - Use strtoutf8() for Audio GAP device name
  - Use strtoutf8() for EIR device names

Frédéric Danis (5):
  shared/util: Add strtoutf8 function audio/avrcp: Fix crash with invalid UTF-8 item name audio/mcp: Use strtoutf8 for player name and track title audio/gap: Use strtoutf8 for GAP device name
  eir: Use strtoutf8 for device names

 profiles/audio/avrcp.c |  4 +++-
 profiles/audio/mcp.c   | 11 +----------
 profiles/gap/gas.c     | 11 +----------
 src/eir.c              | 11 +----------
 src/shared/util.c      | 42
++++++++++++++++++++++++++++++++++++++++++
 src/shared/util.h      |  1 +

 6 files changed, 49 insertions(+), 31 deletions(-)

Quoted 29 lines · Frédéric Danis

As stated in AVRCP 1.6.2 chapter 6.10.2.3 Media element item, for the Displayable Name Length property, the target device may truncate the item name:

Length of Displayable Name in octets. The name shall be limited
such
that a response to a GetFolderItems containing one media player
item
fits within the maximum size of PDU which can be received by the
CT.

This truncatation may occur in the middle of a multi-byte character, at least with Samsung Music app, which triggers a DBus assertion and crashes bluetoothd:

profiles/audio/player.c:media_folder_create_item() Din Dhal Jaye
Haye with lyrics | "दिन ढल जाए
हाय" गाने के बो� type audio uid 1
profiles/audio/player.c:media_folder_create_item()

      /org/bluez/hci0/dev_24_24_B7_11_82_6C/player0/NowPlaying/item1

profiles/audio/player.c:media_player_set_metadata() Title: Din Dhal
Jaye Haye with lyrics | "दिन ढल जाए हाय"
गाने के बोल | Guide | Dev Anand, Waheeda Rehman
…
arguments to dbus_message_iter_append_basic() were incorrect,
assertion "_dbus_check_is_valid_utf8 (*string_p)" failed in file dbus-message.c line 2775.
This is normally a bug in some application using the D-Bus library.

Quoted 8 lines

v1->v2:
- Introduce new strtoutf8() util function to truncate a string
before
the first non UTF-8 character.
- Use strtoutf8() for AVRCP media element name
- Use strtoutf8() for MCP player name and track title
- Use strtoutf8() for Audio GAP device name
- Use strtoutf8() for EIR device names

Would be great to have a test case for that new function, with a bunch of the problems you ran into tested for.

Quoted 16 lines

Frédéric Danis (5):
shared/util: Add strtoutf8 function audio/avrcp: Fix crash with invalid UTF-8 item name audio/mcp: Use strtoutf8 for player name and track title audio/gap: Use strtoutf8 for GAP device name
eir: Use strtoutf8 for device names

 profiles/audio/avrcp.c |  4 +++-
 profiles/audio/mcp.c   | 11 +----------
 profiles/gap/gas.c     | 11 +----------
 src/eir.c              | 11 +----------
 src/shared/util.c      | 42
++++++++++++++++++++++++++++++++++++++++++
 src/shared/util.h      |  1 +
 6 files changed, 49 insertions(+), 31 deletions(-)