From 9e6cefaa2d70a7610929e2aaaa88a884f405522d Mon Sep 17 00:00:00 2001
From: pkgagent <pkgagent@tencent.com>
Date: Wed, 26 Aug 2026 22:15:40 +0800
Subject: [PATCH] Fix CVE-2026-80186: stack buffer overflow when parsing EIR
 remote name in eir.c

---
 bluez-5.64-CVE-2026-80186.patch | 40 +++++++++++++++++++++++++++++++++
 bluez.spec                      |  8 ++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 bluez-5.64-CVE-2026-80186.patch

diff --git a/bluez-5.64-CVE-2026-80186.patch b/bluez-5.64-CVE-2026-80186.patch
new file mode 100644
index 0000000..8878f41
--- /dev/null
+++ b/bluez-5.64-CVE-2026-80186.patch
@@ -0,0 +1,40 @@
+From 381b5d0d208972586282116d333865ba93b8dec2 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Wed, 19 Aug 2026 16:02:47 -0400
+Subject: [PATCH] eir: Fix stack buffer overflow when parsing the remote name
+
+name2utf8() copies len bytes into a HCI_MAX_NAME_LENGTH + 2, so 250,
+byte stack buffer without clamping len first.
+
+eir_parse() only rejects a field once it runs past the end of the EIR
+data, and that data is up to 255 bytes, so field_len can be 254 and the
+data_len passed to name2utf8() can reach 253. strncpy() then writes 253
+bytes into the 250 byte buffer and leaves it unterminated, so the
+following g_strstrip() and g_strdup() also read past the end.
+
+The EIR data comes from a remote device, either in an extended inquiry
+response or in an advertising report, so the length is attacker
+controlled.
+
+Clamp len to HCI_MAX_NAME_LENGTH, which is what the local name is
+limited to anyway, and what ad_replace_name() already clamps to.
+
+Fixes: https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975
+Assisted-by: Claude:claude-opus-5
+Adapted-by: PkgAgent/deepseek-v4 (hunk context relocated for bluez 5.64)
+---
+ src/eir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+diff --git a/src/eir.c b/src/eir.c
+index 2f9ee03..6f9a7a7 100644
+--- a/src/eir.c
++++ b/src/eir.c
+@@ -132,6 +132,8 @@ static char *name2utf8(const uint8_t *name, uint8_t len)
+ 	if (g_utf8_validate((const char *) name, len, NULL))
+ 		return g_strndup((char *) name, len);
+ 
++	len = MIN(len, HCI_MAX_NAME_LENGTH);
++
+ 	memset(utf8_name, 0, sizeof(utf8_name));
+ 	strncpy(utf8_name, (char *) name, len);
+ 
diff --git a/bluez.spec b/bluez.spec
index f70dcf1..87bf04c 100644
--- a/bluez.spec
+++ b/bluez.spec
@@ -1,7 +1,7 @@
 Summary: Bluetooth utilities
 Name:    bluez
 Version: 5.64
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: GPLv2+
 URL:     http://www.bluez.org/
 Source0: http://www.kernel.org/pub/linux/bluetooth/%{name}-%{version}.tar.xz
@@ -14,6 +14,8 @@ Patch0002: 0001-mgmt-tester-Fix-null-dereference-issue-reported-by-s.patch
 Patch0003: 0001-avrcp-Fix-crash-while-handling-unsupported-events.patch
 # CVE-2023-50230, CVE-2023-50229
 Patch0004: 0001-pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch
+# CVE-2026-80186
+Patch0005: bluez-5.64-CVE-2026-80186.patch
 
 Patch3001: 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch
 
@@ -244,6 +246,10 @@ find %{buildroot} -name '*.la' -delete
 %{_userunitdir}/obex.service
 
 %changelog
+* Wed Aug 26 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 5.64-7
+- [Type] security
+- [DESC] Fix CVE-2026-80186: stack buffer overflow when parsing EIR remote name in eir.c
+
 * Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 5.64-6
 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream
 
-- 
Gitee