Sync from SUSE:ALP:Source:Standard:1.0 bluez revision 3521e5c4f30afecaa07905fe0121fd7a

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch

@@ -0,0 +1,35 @@
+From 4de2871675d3b039b5797e77cc1d6ce4070e86b2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 16 Feb 2016 16:39:09 +0000
+Subject: [PATCH] bcm43xx: The UART speed must be reset after the firmware
+ download
+
+---
+ tools/hciattach_bcm43xx.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+Index: bluez-5.60/tools/hciattach_bcm43xx.c
+===================================================================
+--- bluez-5.60.orig/tools/hciattach_bcm43xx.c
++++ bluez-5.60/tools/hciattach_bcm43xx.c
+@@ -354,11 +354,8 @@ int bcm43xx_init(int fd, int def_speed,
+ 		return -1;
+ 
+ 	if (bcm43xx_locate_patch(FIRMWARE_DIR, chip_name, fw_path)) {
+-		fprintf(stderr, "Patch not found, continue anyway\n");
++		fprintf(stderr, "Patch not found for %s, continue anyway\n", chip_name);
+ 	} else {
+-		if (bcm43xx_set_speed(fd, ti, speed))
+-			return -1;
+-
+ 		if (bcm43xx_load_firmware(fd, fw_path))
+ 			return -1;
+ 
+@@ -368,6 +365,7 @@ int bcm43xx_init(int fd, int def_speed,
+ 			return -1;
+ 		}
+ 
++		sleep(1);
+ 		if (bcm43xx_reset(fd))
+ 			return -1;
+ 	}

CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch

@@ -0,0 +1,34 @@
+# Upstream suggests to use btmon instead of hcidump and does not want those patches
+# => PATCH-FIX-OPENSUSE for those two :-)
+# fix some memory leak with malformed packet (reported upstream but not yet fixed)
+
+From 5ca9510314d15d562e9ef5515a5483be5f28258d Mon Sep 17 00:00:00 2001
+From: "Cho, Yu-Chen" <acho@suse.com>
+Date: Wed, 21 Mar 2018 17:32:45 +0800
+Subject: [PATCH BlueZ] tool/hcidump: Fix memory leak with malformed packet
+
+Do not allow to read more then buffer size.
+---
+ tools/parser/hci.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+Index: bluez-5.65/tools/parser/hci.c
+===================================================================
+--- bluez-5.65.orig/tools/parser/hci.c
++++ bluez-5.65/tools/parser/hci.c
+@@ -976,8 +976,14 @@ static inline void pin_code_reply_dump(i
+ 	memset(pin, 0, sizeof(pin));
+ 	if (parser.flags & DUMP_NOVENDOR)
+ 		memset(pin, '*', cp->pin_len);
+-	else
++	else {
++                 if (cp->pin_len > sizeof(pin)){
++                        perror("Read failed");
++                        exit(1);
++                }
++
+ 		memcpy(pin, cp->pin_code, cp->pin_len);
++	}
+ 	printf("bdaddr %s len %d pin \'%s\'\n", addr, cp->pin_len, pin);
+ }
+ 

CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch

@@ -0,0 +1,31 @@
+# Upstream suggests to use btmon instead of hcidump and does not want those patches
+# => PATCH-FIX-OPENSUSE for those two :-)
+# fix some memory leak with malformed packet (reported upstream but not yet fixed)
+
+From 00f50518f232c758855ac9884a841f707f41a301 Mon Sep 17 00:00:00 2001
+From: "Cho, Yu-Chen" <acho@suse.com>
+Date: Thu, 3 May 2018 18:52:19 +0800
+Subject: [PATCH BlueZ] tool/hcidump: Fix memory leak with malformed packet
+
+The Supported Commands is a 64 octet bit field.
+Do not allow to read more then the size.
+---
+ tools/parser/csr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+Index: bluez-5.65/tools/parser/csr.c
+===================================================================
+--- bluez-5.65.orig/tools/parser/csr.c
++++ bluez-5.65/tools/parser/csr.c
+@@ -133,6 +133,11 @@ static inline void commands_dump(int lev
+ 	unsigned char commands[64];
+ 	unsigned int i;
+ 
++	if (frm->len > 64) {
++		perror("Read failed");
++		exit(1);
++	}
++
+ 	memcpy(commands, frm->ptr, frm->len);
+ 
+ 	p_indent(level, frm);

Fix-.device_probe-failing-if-SDP-record-is-not.patch

@@ -0,0 +1,310 @@
+From 3a9c637010f8dc1ba3e8382abe01065761d4f5bb Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 10 Oct 2023 12:38:29 -0700
+Subject: [PATCH] input: Fix .device_probe failing if SDP record is not found
+
+Due to changes introduced by 67a26abe53bf
+("profile: Add probe_on_discover flag") profiles may get probed when
+their profile UUID are discovered, rather than resolved, which means
+the SDP record may not be available.
+
+Fixes: https://github.com/bluez/bluez/issues/614
+---
+ profiles/input/device.c | 182 +++++++++++++++++++---------------------
+ 1 file changed, 84 insertions(+), 98 deletions(-)
+
+diff --git a/profiles/input/device.c b/profiles/input/device.c
+index e2ac6ea60..4a50ea992 100644
+--- a/profiles/input/device.c
++++ b/profiles/input/device.c
+@@ -60,7 +60,7 @@ struct input_device {
+ 	char			*path;
+ 	bdaddr_t		src;
+ 	bdaddr_t		dst;
+-	uint32_t		handle;
++	const sdp_record_t	*rec;
+ 	GIOChannel		*ctrl_io;
+ 	GIOChannel		*intr_io;
+ 	guint			ctrl_watch;
+@@ -754,7 +754,8 @@ static void epox_endian_quirk(unsigned char *data, int size)
+ 	}
+ }
+ 
+-static int create_hid_dev_name(sdp_record_t *rec, struct hidp_connadd_req *req)
++static int create_hid_dev_name(const sdp_record_t *rec,
++					struct hidp_connadd_req *req)
+ {
+ 	char sdesc[sizeof(req->name) / 2];
+ 
+@@ -776,7 +777,7 @@ static int create_hid_dev_name(sdp_record_t *rec, struct hidp_connadd_req *req)
+ 
+ /* See HID profile specification v1.0, "7.11.6 HIDDescriptorList" for details
+  * on the attribute format. */
+-static int extract_hid_desc_data(sdp_record_t *rec,
++static int extract_hid_desc_data(const sdp_record_t *rec,
+ 						struct hidp_connadd_req *req)
+ {
+ 	sdp_data_t *d;
+@@ -817,36 +818,40 @@ invalid_desc:
+ 	return -EINVAL;
+ }
+ 
+-static int extract_hid_record(sdp_record_t *rec, struct hidp_connadd_req *req)
++static int extract_hid_record(struct input_device *idev,
++					struct hidp_connadd_req *req)
+ {
+ 	sdp_data_t *pdlist;
+ 	uint8_t attr_val;
+ 	int err;
+ 
+-	err = create_hid_dev_name(rec, req);
++	if (!idev->rec)
++		return -ENOENT;
++
++	err = create_hid_dev_name(idev->rec, req);
+ 	if (err < 0)
+ 		DBG("No valid Service Name or Service Description found");
+ 
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_PARSER_VERSION);
++	pdlist = sdp_data_get(idev->rec, SDP_ATTR_HID_PARSER_VERSION);
+ 	req->parser = pdlist ? pdlist->val.uint16 : 0x0100;
+ 
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_DEVICE_SUBCLASS);
++	pdlist = sdp_data_get(idev->rec, SDP_ATTR_HID_DEVICE_SUBCLASS);
+ 	req->subclass = pdlist ? pdlist->val.uint8 : 0;
+ 
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_COUNTRY_CODE);
++	pdlist = sdp_data_get(idev->rec, SDP_ATTR_HID_COUNTRY_CODE);
+ 	req->country = pdlist ? pdlist->val.uint8 : 0;
+ 
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_VIRTUAL_CABLE);
++	pdlist = sdp_data_get(idev->rec, SDP_ATTR_HID_VIRTUAL_CABLE);
+ 	attr_val = pdlist ? pdlist->val.uint8 : 0;
+ 	if (attr_val)
+ 		req->flags |= (1 << HIDP_VIRTUAL_CABLE_UNPLUG);
+ 
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_BOOT_DEVICE);
++	pdlist = sdp_data_get(idev->rec, SDP_ATTR_HID_BOOT_DEVICE);
+ 	attr_val = pdlist ? pdlist->val.uint8 : 0;
+ 	if (attr_val)
+ 		req->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
+ 
+-	err = extract_hid_desc_data(rec, req);
++	err = extract_hid_desc_data(idev->rec, req);
+ 	if (err < 0)
+ 		return err;
+ 
+@@ -1035,11 +1040,6 @@ static gboolean encrypt_notify(GIOChannel *io, GIOCondition condition,
+ static int hidp_add_connection(struct input_device *idev)
+ {
+ 	struct hidp_connadd_req *req;
+-	sdp_record_t *rec;
+-	char src_addr[18], dst_addr[18];
+-	char filename[PATH_MAX];
+-	GKeyFile *key_file;
+-	char handle[11], *str;
+ 	GError *gerr = NULL;
+ 	int err;
+ 
+@@ -1049,33 +1049,7 @@ static int hidp_add_connection(struct input_device *idev)
+ 	req->flags     = 0;
+ 	req->idle_to   = idle_timeout;
+ 
+-	ba2str(&idev->src, src_addr);
+-	ba2str(&idev->dst, dst_addr);
+-
+-	snprintf(filename, PATH_MAX, STORAGEDIR "/%s/cache/%s", src_addr,
+-								dst_addr);
+-	sprintf(handle, "0x%8.8X", idev->handle);
+-
+-	key_file = g_key_file_new();
+-	if (!g_key_file_load_from_file(key_file, filename, 0, &gerr)) {
+-		error("Unable to load key file from %s: (%s)", filename,
+-								gerr->message);
+-		g_clear_error(&gerr);
+-	}
+-	str = g_key_file_get_string(key_file, "ServiceRecords", handle, NULL);
+-	g_key_file_free(key_file);
+-
+-	if (!str) {
+-		error("Rejected connection from unknown device %s", dst_addr);
+-		err = -EPERM;
+-		goto cleanup;
+-	}
+-
+-	rec = record_from_string(str);
+-	g_free(str);
+-
+-	err = extract_hid_record(rec, req);
+-	sdp_record_free(rec);
++	err = extract_hid_record(idev, req);
+ 	if (err < 0) {
+ 		error("Could not parse HID SDP record: %s (%d)", strerror(-err),
+ 									-err);
+@@ -1091,7 +1065,7 @@ static int hidp_add_connection(struct input_device *idev)
+ 
+ 	/* Make sure the device is bonded if required */
+ 	if (classic_bonded_only && !input_device_bonded(idev)) {
+-		error("Rejected connection from !bonded device %s", dst_addr);
++		error("Rejected connection from !bonded device %s", idev->path);
+ 		goto cleanup;
+ 	}
+ 
+@@ -1161,6 +1135,68 @@ static int connection_disconnect(struct input_device *idev, uint32_t flags)
+ 		return ioctl_disconnect(idev, flags);
+ }
+ 
++static bool is_device_sdp_disable(const sdp_record_t *rec)
++{
++	sdp_data_t *data;
++
++	data = sdp_data_get(rec, SDP_ATTR_HID_SDP_DISABLE);
++
++	return data && data->val.uint8;
++}
++
++static enum reconnect_mode_t hid_reconnection_mode(bool reconnect_initiate,
++						bool normally_connectable)
++{
++	if (!reconnect_initiate && !normally_connectable)
++		return RECONNECT_NONE;
++	else if (!reconnect_initiate && normally_connectable)
++		return RECONNECT_HOST;
++	else if (reconnect_initiate && !normally_connectable)
++		return RECONNECT_DEVICE;
++	else /* (reconnect_initiate && normally_connectable) */
++		return RECONNECT_ANY;
++}
++
++static void extract_hid_props(struct input_device *idev,
++					const sdp_record_t *rec)
++{
++	/* Extract HID connectability */
++	bool reconnect_initiate, normally_connectable;
++	sdp_data_t *pdlist;
++
++	/* HIDNormallyConnectable is optional and assumed FALSE if not
++	 * present.
++	 */
++	pdlist = sdp_data_get(rec, SDP_ATTR_HID_RECONNECT_INITIATE);
++	reconnect_initiate = pdlist ? pdlist->val.uint8 : TRUE;
++
++	pdlist = sdp_data_get(rec, SDP_ATTR_HID_NORMALLY_CONNECTABLE);
++	normally_connectable = pdlist ? pdlist->val.uint8 : FALSE;
++
++	/* Update local values */
++	idev->reconnect_mode =
++		hid_reconnection_mode(reconnect_initiate, normally_connectable);
++}
++
++static void input_device_update_rec(struct input_device *idev)
++{
++	struct btd_profile *p = btd_service_get_profile(idev->service);
++	const sdp_record_t *rec;
++
++	rec = btd_device_get_record(idev->device, p->remote_uuid);
++	if (!rec || idev->rec == rec)
++		return;
++
++	idev->rec = rec;
++	idev->disable_sdp = is_device_sdp_disable(rec);
++
++	/* Initialize device properties */
++	extract_hid_props(idev, rec);
++
++	if (idev->disable_sdp)
++		device_set_refresh_discovery(idev->device, false);
++}
++
+ static int input_device_connected(struct input_device *idev)
+ {
+ 	int err;
+@@ -1168,6 +1204,9 @@ static int input_device_connected(struct input_device *idev)
+ 	if (idev->intr_io == NULL || idev->ctrl_io == NULL)
+ 		return -ENOTCONN;
+ 
++	/* Attempt to update SDP record if it had changed */
++	input_device_update_rec(idev);
++
+ 	err = hidp_add_connection(idev);
+ 	if (err < 0)
+ 		return err;
+@@ -1411,74 +1450,21 @@ int input_device_disconnect(struct btd_service *service)
+ 	return 0;
+ }
+ 
+-static bool is_device_sdp_disable(const sdp_record_t *rec)
+-{
+-	sdp_data_t *data;
+-
+-	data = sdp_data_get(rec, SDP_ATTR_HID_SDP_DISABLE);
+-
+-	return data && data->val.uint8;
+-}
+-
+-static enum reconnect_mode_t hid_reconnection_mode(bool reconnect_initiate,
+-						bool normally_connectable)
+-{
+-	if (!reconnect_initiate && !normally_connectable)
+-		return RECONNECT_NONE;
+-	else if (!reconnect_initiate && normally_connectable)
+-		return RECONNECT_HOST;
+-	else if (reconnect_initiate && !normally_connectable)
+-		return RECONNECT_DEVICE;
+-	else /* (reconnect_initiate && normally_connectable) */
+-		return RECONNECT_ANY;
+-}
+-
+-static void extract_hid_props(struct input_device *idev,
+-					const sdp_record_t *rec)
+-{
+-	/* Extract HID connectability */
+-	bool reconnect_initiate, normally_connectable;
+-	sdp_data_t *pdlist;
+-
+-	/* HIDNormallyConnectable is optional and assumed FALSE
+-	* if not present. */
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_RECONNECT_INITIATE);
+-	reconnect_initiate = pdlist ? pdlist->val.uint8 : TRUE;
+-
+-	pdlist = sdp_data_get(rec, SDP_ATTR_HID_NORMALLY_CONNECTABLE);
+-	normally_connectable = pdlist ? pdlist->val.uint8 : FALSE;
+-
+-	/* Update local values */
+-	idev->reconnect_mode =
+-		hid_reconnection_mode(reconnect_initiate, normally_connectable);
+-}
+-
+ static struct input_device *input_device_new(struct btd_service *service)
+ {
+ 	struct btd_device *device = btd_service_get_device(service);
+-	struct btd_profile *p = btd_service_get_profile(service);
+ 	const char *path = device_get_path(device);
+-	const sdp_record_t *rec = btd_device_get_record(device, p->remote_uuid);
+ 	struct btd_adapter *adapter = device_get_adapter(device);
+ 	struct input_device *idev;
+ 
+-	if (!rec)
+-		return NULL;
+-
+ 	idev = g_new0(struct input_device, 1);
+ 	bacpy(&idev->src, btd_adapter_get_address(adapter));
+ 	bacpy(&idev->dst, device_get_address(device));
+ 	idev->service = btd_service_ref(service);
+ 	idev->device = btd_device_ref(device);
+ 	idev->path = g_strdup(path);
+-	idev->handle = rec->handle;
+-	idev->disable_sdp = is_device_sdp_disable(rec);
+-
+-	/* Initialize device properties */
+-	extract_hid_props(idev, rec);
+ 
+-	if (idev->disable_sdp)
+-		device_set_refresh_discovery(device, false);
++	input_device_update_rec(idev);
+ 
+ 	return idev;
+ }
+-- 
+2.42.0
+

baselibs.conf

@@ -0,0 +1,4 @@
+libbluetooth3
+bluez-devel
+	requires -bluez-<targettype>
+	requires "libbluetooth3-<targettype> = <version>"

bluetooth.modprobe

@@ -0,0 +1,3 @@
+# use "reset=1" as default, since it should be safe for recent devices and
+# solves all kind of problems.
+options btusb reset=1

bluez-5.11-logitech-hid2hci.patch

@@ -0,0 +1,25 @@
+# fix some logitech HID devices, bnc#681049, bnc#850478 --seife+obs@b1-systems.com
+
+Apparently some Logitech devices need different rules.
+https://bugzilla.novell.com/show_bug.cgi?id=681049
+https://bugzilla.novell.com/show_bug.cgi?id=850478
+
+Index: b/tools/hid2hci.rules
+===================================================================
+--- a/tools/hid2hci.rules
++++ b/tools/hid2hci.rules
+@@ -9,11 +9,13 @@ SUBSYSTEM!="usb*", GOTO="hid2hci_end"
+ ATTR{bInterfaceClass}=="03", ATTR{bInterfaceSubClass}=="01", ATTR{bInterfaceProtocol}=="02", \
+   ATTRS{bDeviceClass}=="00", ATTRS{idVendor}=="413c", ATTRS{bmAttributes}=="e0", \
+   RUN+="hid2hci --method=dell --devpath=%p", ENV{HID2HCI_SWITCH}="1"
+ 
+ # Logitech devices
+-KERNEL=="hiddev*", ATTRS{idVendor}=="046d", ATTRS{idProduct}=="c70[345abce]|c71[34bc]", \
++KERNEL=="hiddev*", ATTRS{idVendor}=="046d", ATTRS{idProduct}=="c70[5e]", \
++  RUN+="hid2hci --method=logitech-hid --devpath=%p"
++KERNEL=="hidraw*", ATTRS{idVendor}=="046d", ATTRS{idProduct}=="c70[34abc]|c71[34bc]", \
+   RUN+="hid2hci --method=logitech-hid --devpath=%p"
+ 
+ ENV{DEVTYPE}!="usb_device", GOTO="hid2hci_end"
+ 
+ # When a Dell device recovers from S3, the mouse child needs to be repoked

bluez-cups-libexec.patch

@@ -0,0 +1,26 @@
+Index: bluez-5.65/Makefile.in
+===================================================================
+--- bluez-5.65.orig/Makefile.in
++++ bluez-5.65/Makefile.in
+@@ -3871,7 +3871,7 @@ unit_tests = $(am__append_55) unit/test-
+ @DEPRECATED_TRUE@@READLINE_TRUE@attrib_gatttool_LDADD = lib/libbluetooth-internal.la \
+ @DEPRECATED_TRUE@@READLINE_TRUE@			src/libshared-glib.la $(GLIB_LIBS) -lreadline
+ 
+-@CUPS_TRUE@cupsdir = $(libdir)/cups/backend
++@CUPS_TRUE@cupsdir = $(prefix)/lib/cups/backend
+ @CUPS_TRUE@profiles_cups_bluetooth_SOURCES = profiles/cups/main.c \
+ @CUPS_TRUE@					profiles/cups/cups.h \
+ @CUPS_TRUE@					profiles/cups/sdp.c \
+Index: bluez-5.65/Makefile.tools
+===================================================================
+--- bluez-5.65.orig/Makefile.tools
++++ bluez-5.65/Makefile.tools
+@@ -499,7 +499,7 @@ endif
+ endif
+ 
+ if CUPS
+-cupsdir = $(libdir)/cups/backend
++cupsdir = $(prefix)/lib/cups/backend
+ 
+ cups_PROGRAMS = profiles/cups/bluetooth
+ 

bluez-disable-broken-tests.diff

@@ -0,0 +1,13 @@
+Index: bluez-5.65/Makefile.am
+===================================================================
+--- bluez-5.65.orig/Makefile.am
++++ bluez-5.65/Makefile.am
+@@ -572,7 +574,7 @@ unit_test_midi_LDADD = src/libshared-gli
+ endif
+ 
+ if MESH
+-unit_tests += unit/test-mesh-crypto
++#unit_tests += unit/test-mesh-crypto
+ unit_test_mesh_crypto_CPPFLAGS = $(ell_cflags)
+ unit_test_mesh_crypto_SOURCES = unit/test-mesh-crypto.c \
+ 				mesh/crypto.h ell/internal ell/ell.h

bluez-sdp-unix-path.patch

@@ -0,0 +1,13 @@
+Index: bluez-5.65/lib/sdp.h
+===================================================================
+--- bluez-5.65.orig/lib/sdp.h
++++ bluez-5.65/lib/sdp.h
+@@ -21,7 +21,7 @@ extern "C" {
+ #include <stdint.h>
+ #include <bluetooth/bluetooth.h>
+ 
+-#define SDP_UNIX_PATH "/var/run/sdp"
++#define SDP_UNIX_PATH "/run/sdp"
+ #define SDP_RESPONSE_TIMEOUT	20
+ #define SDP_REQ_BUFFER_SIZE	2048
+ #define SDP_RSP_BUFFER_SIZE	65535

bluez-test-2to3.diff

@@ -0,0 +1,601 @@
+Index: bluez-5.65/test/bluezutils.py
+===================================================================
+--- bluez-5.65.orig/test/bluezutils.py
++++ bluez-5.65/test/bluezutils.py
+@@ -17,7 +17,7 @@ def find_adapter(pattern=None):
+ 
+ def find_adapter_in_objects(objects, pattern=None):
+ 	bus = dbus.SystemBus()
+-	for path, ifaces in objects.items():
++	for path, ifaces in list(objects.items()):
+ 		adapter = ifaces.get(ADAPTER_INTERFACE)
+ 		if adapter is None:
+ 			continue
+@@ -37,7 +37,7 @@ def find_device_in_objects(objects, devi
+ 	if adapter_pattern:
+ 		adapter = find_adapter_in_objects(objects, adapter_pattern)
+ 		path_prefix = adapter.object_path
+-	for path, ifaces in objects.items():
++	for path, ifaces in list(objects.items()):
+ 		device = ifaces.get(DEVICE_INTERFACE)
+ 		if device is None:
+ 			continue
+Index: bluez-5.65/test/example-advertisement
+===================================================================
+--- bluez-5.65.orig/test/example-advertisement
++++ bluez-5.65/test/example-advertisement
+@@ -164,7 +164,7 @@ def find_adapter(bus):
+                                DBUS_OM_IFACE)
+     objects = remote_om.GetManagedObjects()
+ 
+-    for o, props in objects.items():
++    for o, props in list(objects.items()):
+         if LE_ADVERTISING_MANAGER_IFACE in props:
+             return o
+ 
+Index: bluez-5.65/test/example-gatt-client
+===================================================================
+--- bluez-5.65.orig/test/example-gatt-client
++++ bluez-5.65/test/example-gatt-client
+@@ -33,7 +33,7 @@ hr_ctrl_pt_chrc = None
+ 
+ 
+ def generic_error_cb(error):
+-    print('D-Bus call failed: ' + str(error))
++    print(('D-Bus call failed: ' + str(error)))
+     mainloop.quit()
+ 
+ 
+@@ -69,10 +69,10 @@ def sensor_contact_val_to_str(val):
+ 
+ def body_sensor_val_cb(value):
+     if len(value) != 1:
+-        print('Invalid body sensor location value: ' + repr(value))
++        print(('Invalid body sensor location value: ' + repr(value)))
+         return
+ 
+-    print('Body sensor location value: ' + body_sensor_val_to_str(value[0]))
++    print(('Body sensor location value: ' + body_sensor_val_to_str(value[0])))
+ 
+ 
+ def hr_msrmt_start_notify_cb():
+@@ -104,12 +104,12 @@ def hr_msrmt_changed_cb(iface, changed_p
+         hr_msrmt = value[1] | (value[2] << 8)
+         next_ind = 3
+ 
+-    print('\tHR: ' + str(int(hr_msrmt)))
+-    print('\tSensor Contact status: ' +
+-          sensor_contact_val_to_str(sc_status))
++    print(('\tHR: ' + str(int(hr_msrmt))))
++    print(('\tSensor Contact status: ' +
++          sensor_contact_val_to_str(sc_status)))
+ 
+     if ee_status:
+-        print('\tEnergy Expended: ' + str(int(value[next_ind])))
++        print(('\tEnergy Expended: ' + str(int(value[next_ind]))))
+ 
+ 
+ def start_client():
+@@ -147,7 +147,7 @@ def process_chrc(chrc_path):
+         global hr_ctrl_pt_chrc
+         hr_ctrl_pt_chrc = (chrc, chrc_props)
+     else:
+-        print('Unrecognized characteristic: ' + uuid)
++        print(('Unrecognized characteristic: ' + uuid))
+ 
+     return True
+ 
+@@ -162,7 +162,7 @@ def process_hr_service(service_path, chr
+     if uuid != HR_SVC_UUID:
+         return False
+ 
+-    print('Heart Rate Service found: ' + service_path)
++    print(('Heart Rate Service found: ' + service_path))
+ 
+     # Process the characteristics.
+     for chrc_path in chrc_paths:
+@@ -199,14 +199,14 @@ def main():
+     chrcs = []
+ 
+     # List characteristics found
+-    for path, interfaces in objects.items():
+-        if GATT_CHRC_IFACE not in interfaces.keys():
++    for path, interfaces in list(objects.items()):
++        if GATT_CHRC_IFACE not in list(interfaces.keys()):
+             continue
+         chrcs.append(path)
+ 
+     # List sevices found
+-    for path, interfaces in objects.items():
+-        if GATT_SERVICE_IFACE not in interfaces.keys():
++    for path, interfaces in list(objects.items()):
++        if GATT_SERVICE_IFACE not in list(interfaces.keys()):
+             continue
+ 
+         chrc_paths = [d for d in chrcs if d.startswith(path + "/")]
+Index: bluez-5.65/test/example-gatt-server
+===================================================================
+--- bluez-5.65.orig/test/example-gatt-server
++++ bluez-5.65/test/example-gatt-server
+@@ -293,7 +293,7 @@ class HeartRateMeasurementChrc(Character
+                 min(0xffff, self.service.energy_expended + 1)
+         self.hr_ee_count += 1
+ 
+-        print('Updating value: ' + repr(value))
++        print(('Updating value: ' + repr(value)))
+ 
+         self.PropertiesChanged(GATT_CHRC_IFACE, { 'Value': value }, [])
+ 
+@@ -355,7 +355,7 @@ class HeartRateControlPointChrc(Characte
+             raise InvalidValueLengthException()
+ 
+         byte = value[0]
+-        print('Control Point value: ' + repr(byte))
++        print(('Control Point value: ' + repr(byte)))
+ 
+         if byte != 1:
+             raise FailedException("0x80")
+@@ -408,12 +408,12 @@ class BatteryLevelCharacteristic(Charact
+             self.battery_lvl -= 2
+             if self.battery_lvl < 0:
+                 self.battery_lvl = 0
+-        print('Battery Level drained: ' + repr(self.battery_lvl))
++        print(('Battery Level drained: ' + repr(self.battery_lvl)))
+         self.notify_battery_level()
+         return True
+ 
+     def ReadValue(self, options):
+-        print('Battery Level read: ' + repr(self.battery_lvl))
++        print(('Battery Level read: ' + repr(self.battery_lvl)))
+         return [dbus.Byte(self.battery_lvl)]
+ 
+     def StartNotify(self):
+@@ -466,11 +466,11 @@ class TestCharacteristic(Characteristic)
+                 CharacteristicUserDescriptionDescriptor(bus, 1, self))
+ 
+     def ReadValue(self, options):
+-        print('TestCharacteristic Read: ' + repr(self.value))
++        print(('TestCharacteristic Read: ' + repr(self.value)))
+         return self.value
+ 
+     def WriteValue(self, value, options):
+-        print('TestCharacteristic Write: ' + repr(value))
++        print(('TestCharacteristic Write: ' + repr(value)))
+         self.value = value
+ 
+ 
+@@ -538,11 +538,11 @@ class TestEncryptCharacteristic(Characte
+                 CharacteristicUserDescriptionDescriptor(bus, 3, self))
+ 
+     def ReadValue(self, options):
+-        print('TestEncryptCharacteristic Read: ' + repr(self.value))
++        print(('TestEncryptCharacteristic Read: ' + repr(self.value)))
+         return self.value
+ 
+     def WriteValue(self, value, options):
+-        print('TestEncryptCharacteristic Write: ' + repr(value))
++        print(('TestEncryptCharacteristic Write: ' + repr(value)))
+         self.value = value
+ 
+ class TestEncryptDescriptor(Descriptor):
+@@ -584,11 +584,11 @@ class TestSecureCharacteristic(Character
+                 CharacteristicUserDescriptionDescriptor(bus, 3, self))
+ 
+     def ReadValue(self, options):
+-        print('TestSecureCharacteristic Read: ' + repr(self.value))
++        print(('TestSecureCharacteristic Read: ' + repr(self.value)))
+         return self.value
+ 
+     def WriteValue(self, value, options):
+-        print('TestSecureCharacteristic Write: ' + repr(value))
++        print(('TestSecureCharacteristic Write: ' + repr(value)))
+         self.value = value
+ 
+ 
+@@ -616,7 +616,7 @@ def register_app_cb():
+ 
+ 
+ def register_app_error_cb(error):
+-    print('Failed to register application: ' + str(error))
++    print(('Failed to register application: ' + str(error)))
+     mainloop.quit()
+ 
+ 
+@@ -625,8 +625,8 @@ def find_adapter(bus):
+                                DBUS_OM_IFACE)
+     objects = remote_om.GetManagedObjects()
+ 
+-    for o, props in objects.items():
+-        if GATT_MANAGER_IFACE in props.keys():
++    for o, props in list(objects.items()):
++        if GATT_MANAGER_IFACE in list(props.keys()):
+             return o
+ 
+     return None
+Index: bluez-5.65/test/list-devices
+===================================================================
+--- bluez-5.65.orig/test/list-devices
++++ bluez-5.65/test/list-devices
+@@ -33,16 +33,16 @@ def extract_uuids(uuid_list):
+ objects = manager.GetManagedObjects()
+ 
+ all_devices = (str(path) for path, interfaces in objects.items() if
+-					"org.bluez.Device1" in interfaces.keys())
++					"org.bluez.Device1" in list(interfaces.keys()))
+ 
+ for path, interfaces in objects.items():
+-	if "org.bluez.Adapter1" not in interfaces.keys():
++	if "org.bluez.Adapter1" not in list(interfaces.keys()):
+ 		continue
+ 
+ 	print("[ " + path + " ]")
+ 
+ 	properties = interfaces["org.bluez.Adapter1"]
+-	for key in properties.keys():
++	for key in list(properties.keys()):
+ 		value = properties[key]
+ 		if (key == "UUIDs"):
+ 			list = extract_uuids(value)
+@@ -58,7 +58,7 @@ for path, interfaces in objects.items():
+ 		dev = objects[dev_path]
+ 		properties = dev["org.bluez.Device1"]
+ 
+-		for key in properties.keys():
++		for key in list(properties.keys()):
+ 			value = properties[key]
+ 			if (key == "UUIDs"):
+ 				list = extract_uuids(value)
+Index: bluez-5.65/test/pbap-client
+===================================================================
+--- bluez-5.65.orig/test/pbap-client
++++ bluez-5.65/test/pbap-client
+@@ -135,11 +135,11 @@ if  __name__ == '__main__':
+ 			print(header)
+ 		for line in lines:
+ 			print(line),
+-		print
++		print()
+ 
+ 	def test_paths(paths):
+ 		if len(paths) == 0:
+-			print
++			print()
+ 			print("FINISHED")
+ 			mainloop.quit()
+ 			return
+Index: bluez-5.65/test/sap_client.py
+===================================================================
+--- bluez-5.65.orig/test/sap_client.py
++++ bluez-5.65/test/sap_client.py
+@@ -165,7 +165,7 @@ class SAPParam_ConnectionStatus(SAPParam
+ 
+     def __validate(self):
+         if self.value is not None and self.value not in (0x00,  0x01,  0x02,  0x03,  0x04):
+-            print "Warning. ConnectionStatus value in reserved range (0x%x)" % self.value
++            print("Warning. ConnectionStatus value in reserved range (0x%x)" % self.value)
+ 
+     def deserialize(self,  buf):
+         ret = SAPParam.deserialize(self, buf)
+@@ -183,7 +183,7 @@ class SAPParam_ResultCode(SAPParam):
+ 
+     def __validate(self):
+         if self.value is not None and self.value not in (0x00,  0x01,  0x02,  0x03,  0x04,  0x05,  0x06,  0x07):
+-            print "Warning. ResultCode value in reserved range (0x%x)" % self.value
++            print("Warning. ResultCode value in reserved range (0x%x)" % self.value)
+ 
+     def deserialize(self,  buf):
+         ret = SAPParam.deserialize(self, buf)
+@@ -201,7 +201,7 @@ class SAPParam_DisconnectionType(SAPPara
+ 
+     def __validate(self):
+         if self.value is not None and self.value not in (0x00,  0x01):
+-            print "Warning. DisconnectionType value in reserved range (0x%x)" % self.value
++            print("Warning. DisconnectionType value in reserved range (0x%x)" % self.value)
+ 
+     def deserialize(self,  buf):
+         ret = SAPParam.deserialize(self, buf)
+@@ -227,7 +227,7 @@ class SAPParam_StatusChange(SAPParam):
+ 
+     def __validate(self):
+         if self.value is not None and self.value not in (0x00,  0x01,  0x02,  0x03,  0x04,  0x05):
+-            print "Warning. StatusChange value in reserved range (0x%x)" % self.value
++            print("Warning. StatusChange value in reserved range (0x%x)" % self.value)
+ 
+     def deserialize(self,  buf):
+         ret = SAPParam.deserialize(self, buf)
+@@ -245,7 +245,7 @@ class SAPParam_TransportProtocol(SAPPara
+ 
+     def __validate(self):
+         if self.value is not None and self.value not in (0x00,  0x01):
+-            print "Warning. TransportProtoco value in reserved range (0x%x)" % self.value
++            print("Warning. TransportProtoco value in reserved range (0x%x)" % self.value)
+ 
+     def deserialize(self,  buf):
+         ret = SAPParam.deserialize(self, buf)
+@@ -728,7 +728,7 @@ class SAPClient:
+         self.port = first_match["port"]
+         self.host = first_match["host"]
+ 
+-        print "SAP Service found on %s(%s)" % first_match["name"] % self.host
++        print("SAP Service found on %s(%s)" % first_match["name"] % self.host)
+ 
+     def __connectRFCOMM(self):
+         self.sock=BluetoothSocket( RFCOMM )
+@@ -739,19 +739,19 @@ class SAPClient:
+     def __sendMsg(self, msg):
+         if isinstance(msg,  SAPMessage):
+             s = msg.serialize()
+-            print "\tTX: " + msg.getContent()
++            print("\tTX: " + msg.getContent())
+             return self.sock.send(s.tostring())
+ 
+     def __rcvMsg(self,  msg):
+         if isinstance(msg,  SAPMessage):
+-            print "\tRX Wait: %s(id = 0x%.2x)" % (msg.name, msg.id)
++            print("\tRX Wait: %s(id = 0x%.2x)" % (msg.name, msg.id))
+             data = self.sock.recv(self.bufsize)
+             if data:
+                 if msg.deserialize(array('B',data)):
+-                    print "\tRX: len(%d) %s" % (len(data), msg.getContent())
++                    print("\tRX: len(%d) %s" % (len(data), msg.getContent()))
+                     return msg
+                 else:
+-                    print "msg: %s" % array('B',data)
++                    print("msg: %s" % array('B',data))
+                     raise BluetoothError ("Message deserialization failed.")
+             else:
+                 raise BluetoothError ("Timeout. No data received.")
+@@ -797,8 +797,8 @@ class SAPClient:
+                     return False
+             else:
+                 return False
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_disconnectByClient(self, timeout=0):
+@@ -808,8 +808,8 @@ class SAPClient:
+             time.sleep(timeout) # let srv to close rfcomm
+             self.__disconnectRFCOMM()
+             return True
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_disconnectByServer(self, timeout=0):
+@@ -823,8 +823,8 @@ class SAPClient:
+ 
+             return self.proc_disconnectByClient(timeout)
+ 
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_transferAPDU(self,  apdu = "Sample APDU command"):
+@@ -832,8 +832,8 @@ class SAPClient:
+             self.__sendMsg(SAPMessage_TRANSFER_APDU_REQ(apdu))
+             params = self.__rcvMsg(SAPMessage_TRANSFER_APDU_RESP()).getParams()
+             return True
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_transferATR(self):
+@@ -841,8 +841,8 @@ class SAPClient:
+             self.__sendMsg(SAPMessage_TRANSFER_ATR_REQ())
+             params = self.__rcvMsg(SAPMessage_TRANSFER_ATR_RESP()).getParams()
+             return True
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_powerSimOff(self):
+@@ -850,8 +850,8 @@ class SAPClient:
+             self.__sendMsg(SAPMessage_POWER_SIM_OFF_REQ())
+             params = self.__rcvMsg(SAPMessage_POWER_SIM_OFF_RESP()).getParams()
+             return True
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_powerSimOn(self):
+@@ -862,8 +862,8 @@ class SAPClient:
+                 return self.proc_transferATR()
+ 
+             return True
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_resetSim(self):
+@@ -874,23 +874,23 @@ class SAPClient:
+                 return self.proc_transferATR()
+ 
+             return True
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_reportStatus(self):
+         try:
+             params = self.__rcvMsg(SAPMessage_STATUS_IND()).getParams()
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_transferCardReaderStatus(self):
+         try:
+             self.__sendMsg(SAPMessage_TRANSFER_CARD_READER_STATUS_REQ())
+             params = self.__rcvMsg(SAPMessage_TRANSFER_CARD_READER_STATUS_RESP()).getParams()
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_errorResponse(self):
+@@ -899,8 +899,8 @@ class SAPClient:
+             self.__sendMsg(SAPMessage_CONNECT_REQ())
+ 
+             params = self.__rcvMsg(SAPMessage_ERROR_RESP()).getParams()
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+     def proc_setTransportProtocol(self,  protocol = 0):
+@@ -922,8 +922,8 @@ class SAPClient:
+             else:
+                 return False
+ 
+-        except BluetoothError , e:
+-            print "Error. " +str(e)
++        except BluetoothError as e:
++            print("Error. " +str(e))
+             return False
+ 
+ if __name__ == "__main__":
+Index: bluez-5.65/test/simple-agent
+===================================================================
+--- bluez-5.65.orig/test/simple-agent
++++ bluez-5.65/test/simple-agent
+@@ -24,9 +24,9 @@ dev_path = None
+ 
+ def ask(prompt):
+ 	try:
+-		return raw_input(prompt)
+-	except:
+ 		return input(prompt)
++	except:
++		return eval(input(prompt))
+ 
+ def set_trusted(path):
+ 	props = dbus.Interface(bus.get_object("org.bluez", path),
+Index: bluez-5.65/test/simple-player
+===================================================================
+--- bluez-5.65.orig/test/simple-player
++++ bluez-5.65/test/simple-player
+@@ -119,7 +119,7 @@ class InputHandler:
+ 			return True
+ 
+ 		try:
+-			exec "self.player.%s" % s
++			exec("self.player.%s" % s)
+ 		except Exception as e:
+ 			print(e)
+ 			pass
+Index: bluez-5.65/test/test-adapter
+===================================================================
+--- bluez-5.65.orig/test/test-adapter
++++ bluez-5.65/test/test-adapter
+@@ -69,7 +69,7 @@ if (args[0] == "list"):
+ 
+ 			props = interfaces["org.bluez.Adapter1"]
+ 
+-			for (key, value) in props.items():
++			for (key, value) in list(props.items()):
+ 				if (key == "Class"):
+ 					print("    %s = 0x%06x" % (key, value))
+ 				else:
+Index: bluez-5.65/test/test-discovery
+===================================================================
+--- bluez-5.65.orig/test/test-discovery
++++ bluez-5.65/test/test-discovery
+@@ -39,10 +39,10 @@ def print_compact(address, properties):
+ def print_normal(address, properties):
+ 	print("[ " + address + " ]")
+ 
+-	for key in properties.keys():
++	for key in list(properties.keys()):
+ 		value = properties[key]
+ 		if type(value) is dbus.String:
+-			value = unicode(value).encode('ascii', 'replace')
++			value = str(value).encode('ascii', 'replace')
+ 		if (key == "Class"):
+ 			print("    %s = 0x%06x" % (key, value))
+ 		else:
+@@ -71,7 +71,7 @@ def interfaces_added(path, interfaces):
+ 
+ 		if compact and skip_dev(dev, properties):
+ 			return
+-		devices[path] = dict(devices[path].items() + properties.items())
++		devices[path] = dict(list(devices[path].items()) + list(properties.items()))
+ 	else:
+ 		devices[path] = properties
+ 
+@@ -94,7 +94,7 @@ def properties_changed(interface, change
+ 
+ 		if compact and skip_dev(dev, changed):
+ 			return
+-		devices[path] = dict(devices[path].items() + changed.items())
++		devices[path] = dict(list(devices[path].items()) + list(changed.items()))
+ 	else:
+ 		devices[path] = changed
+ 
+Index: bluez-5.65/test/test-hfp
+===================================================================
+--- bluez-5.65.orig/test/test-hfp
++++ bluez-5.65/test/test-hfp
+@@ -186,7 +186,7 @@ class HfpProfile(dbus.service.Object):
+ 		version = 0x0105
+ 		features = 0
+ 		print("NewConnection(%s, %d)" % (path, fd))
+-		for key in properties.keys():
++		for key in list(properties.keys()):
+ 			if key == "Version":
+ 				version = properties[key]
+ 			elif key == "Features":
+Index: bluez-5.65/test/test-profile
+===================================================================
+--- bluez-5.65.orig/test/test-profile
++++ bluez-5.65/test/test-profile
+@@ -34,7 +34,7 @@ class Profile(dbus.service.Object):
+ 	def NewConnection(self, path, fd, properties):
+ 		self.fd = fd.take()
+ 		print("NewConnection(%s, %d)" % (path, self.fd))
+-		for key in properties.keys():
++		for key in list(properties.keys()):
+ 			if key == "Version" or key == "Features":
+ 				print("  %s = 0x%04x" % (key, properties[key]))
+ 			else:
+Index: bluez-5.65/test/map-client
+===================================================================
+--- bluez-5.65.orig/test/map-client
++++ bluez-5.65/test/map-client
+@@ -27,7 +27,7 @@ def unwrap(x):
+     printed. Taken from d-feet """
+ 
+     if isinstance(x, list):
+-        return map(unwrap, x)
++        return list(map(unwrap, x))
+ 
+     if isinstance(x, tuple):
+         return tuple(map(unwrap, x))
+@@ -35,7 +35,7 @@ def unwrap(x):
+     if isinstance(x, dict):
+         return dict([(unwrap(k), unwrap(v)) for k, v in x.items()])
+ 
+-    for t in [unicode, str, long, int, float, bool]:
++    for t in [str, str, int, int, float, bool]:
+         if isinstance(x, t):
+             return t(x)
+ 

bluez.spec

@@ -0,0 +1,489 @@
+#
+# spec file for package bluez
+#
+# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2010-2020 B1 Systems GmbH, Vohburg, Germany
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+%if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150200
+%bcond_without mesh
+%else
+%bcond_with    mesh
+%endif
+%bcond_without bluez_deprecated
+
+%if 0%{?suse_version} < 1550 && 0%{?sle_version} <= 150300
+# systemd-rpm-macros is wrong in 15.3 and below
+%global _modprobedir /lib/modprobe.d
+%endif
+%global modprobe_d_files 50-bluetooth.conf
+
+%if %{undefined _firmwaredir}
+%define _firmwaredir /lib/firmware
+%endif
+
+Name:           bluez
+Version:        5.70
+Release:        0
+Summary:        Bluetooth Stack for Linux
+License:        GPL-2.0-or-later
+Group:          Hardware/Mobile
+URL:            http://www.bluez.org
+Source:         https://www.kernel.org/pub/linux/bluetooth/bluez-%{version}.tar.xz
+# we still want debuginfo
+#KEEP NOSOURCE DEBUGINFO
+Source5:        baselibs.conf
+Source7:        bluetooth.modprobe
+Source9:        bluez.changes.sle
+# fix some logitech HID devices, bnc#681049, bnc#850478 --seife+obs@b1-systems.com
+Patch1:         bluez-5.11-logitech-hid2hci.patch
+Patch2:         bluez-sdp-unix-path.patch
+# PATCH-FIX-UPSTREAM: find the cups dir in libexec not in libdir
+Patch3:         bluez-cups-libexec.patch
+# workaround for broken tests (reported upstream but not yet fixed)
+Patch4:         bluez-disable-broken-tests.diff
+# PATCH-FIX-UPSTREAM: fix regression in pairing gamepads -- https://github.com/bluez/bluez/issues/614
+Patch5:         Fix-.device_probe-failing-if-SDP-record-is-not.patch
+# disable tests for bypass boo#1078285
+Patch12:        disable_some_obex_tests.patch
+# get rid of python2. WARNING: this is autogenerated by 2to3 and might not work
+Patch13:        bluez-test-2to3.diff
+# bsc#1013708 CVE-2016-9797
+Patch14:        hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
+# bsc#1015171 CVE-2016-9917
+Patch15:        hcidump-Fix-memory-leak-with-malformed-packet.patch
+# bsc#1013712 CVE-2016-9798
+Patch16:        hcidump-Fixed-malformed-segment-frame-length.patch
+# Upstream suggests to use btmon instead of hcidump and does not want those patches
+# => PATCH-FIX-OPENSUSE for those two :-)
+# fix some memory leak with malformed packet (reported upstream but not yet fixed)
+Patch101:       CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
+Patch102:       CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
+# Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902
+Patch201:       0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
+# mesh-cfgtest only compiles with gcc8 or newer, Leap 15 has gcc7.5.0 as default
+%if 0%{?suse_version} < 1550
+BuildRequires:  gcc8
+%endif
+BuildRequires:  automake
+BuildRequires:  flex
+BuildRequires:  libtool
+BuildRequires:  pkgconfig
+BuildRequires:  readline-devel
+BuildRequires:  systemd-rpm-macros
+BuildRequires:  pkgconfig(alsa)
+BuildRequires:  pkgconfig(check)
+BuildRequires:  pkgconfig(dbus-1) >= 1.6
+BuildRequires:  pkgconfig(glib-2.0) >= 2.28
+BuildRequires:  pkgconfig(libcap-ng)
+BuildRequires:  pkgconfig(libical)
+BuildRequires:  pkgconfig(libudev)
+BuildRequires:  pkgconfig(sndfile)
+BuildRequires:  pkgconfig(udev)
+# for rst2man
+BuildRequires:  python3-docutils
+# libgio-2_0-0 has a runtime dependency on shared-mime-info, which is not
+# required for building here, but causes a build loop
+#!BuildIgnore:  shared-mime-info
+Requires(post): systemd
+Recommends:     sbc
+Provides:       bluez-utils = 3.36
+Obsoletes:      bluez-utils < 3.36
+Provides:       bluez-audio = 3.36
+Obsoletes:      bluez-audio < 3.36
+Obsoletes:      bluez-hcidump < 5.0
+Provides:       bluez-hcidump = %{version}
+Obsoletes:      obexd-client < 5.0
+Provides:       obexd-client = %{version}
+%{?systemd_requires}
+%if 0%{?suse_version} >= 1550
+BuildRequires:  pkgconfig(ell) >= 0.39
+%endif
+%if %{with mesh}
+# json-c is needed for --enable-mesh
+BuildRequires:  pkgconfig(json-c)
+%endif
+
+%description
+BlueZ provides support for the core Bluetooth layers and protocols.
+
+%package devel
+Summary:        Files needed for BlueZ development
+License:        GPL-2.0-or-later
+Group:          Development/Languages/C and C++
+Requires:       libbluetooth3 = %{version}
+
+%description devel
+Files needed to develop applications for the BlueZ Bluetooth protocol
+stack.
+
+%package -n libbluetooth3
+Summary:        Bluetooth Libraries
+License:        GPL-2.0-or-later
+Group:          System/Libraries
+Provides:       bluez-libs = 3.36
+Obsoletes:      bluez-libs < 3.36
+
+%description -n libbluetooth3
+BlueZ provides support for the core Bluetooth layers and protocols.
+It is uses a modular implementation. It has many interesting features:
+
+* Multithreaded data processing
+* Support for multiple Bluetooth devices
+* Real hardware abstraction
+* Standard socket interface to all layers
+* Device and service level security support
+
+%package cups
+Summary:        CUPS Driver for Bluetooth Printers
+License:        GPL-2.0-or-later
+Group:          Hardware/Printing
+Requires:       %{name}
+Requires:       cups
+Supplements:    (%{name} and cups)
+
+%description cups
+Contains the files required by CUPS for printing to Bluetooth-connected
+printers.
+
+%package test
+Summary:        Tools for testing of various Bluetooth-functions
+License:        GPL-2.0-or-later AND MIT
+Group:          Development/Tools/Debuggers
+Requires:       python3-dbus-python
+Requires:       python3-gobject
+
+%description test
+Contains a few tools for testing various bluetooth functions. The
+BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.
+
+%package auto-enable-devices
+Summary:        Configuration that automatically enables all bluetooth devices
+License:        GPL-2.0-or-later
+Group:          Hardware/Mobile
+BuildArch:      noarch
+Requires(post): systemd
+
+%description auto-enable-devices
+Contains configuration that automatically enables all bluetooth devices
+that are connected to the system if no other tool is handling them (e.g.
+desktop specific applets like blueman or GNOME or KDE applets).
+
+%post auto-enable-devices
+{  systemctl status -n0 bluetooth.service > /dev/null && systemctl restart bluetooth.service ; } ||:
+
+%postun auto-enable-devices
+{  systemctl status -n0 bluetooth.service > /dev/null && systemctl restart bluetooth.service ; } ||:
+
+%if %{with bluez_deprecated}
+%package deprecated
+Summary:        Bluez tools that upstream considers obsolete
+License:        GPL-2.0-or-later
+Group:          Hardware/Mobile
+
+%description deprecated
+This package contains tools from the bluez package that are only built
+if the "--enable-deprecated" switch is used. These are considered obsolete
+by the upstream developers and might contain serious issues, even security
+bugs. Use at your own risk.
+
+Note that this package will go away before end of 2020, change your code
+to use the modern tools instead.
+%endif
+
+%package obexd
+Summary:        Object Exchange daemon for sharing content
+License:        GPL-2.0-or-later
+Group:          Hardware/Mobile
+Requires:       bluez = %{version}
+
+%description obexd
+Object Exchange daemon for sharing content.
+
+%package zsh-completion
+Summary:        Zsh completion for bluez
+Group:          System/Management
+Requires:       %{name}
+Requires:       zsh
+Supplements:    (%{name} and zsh)
+BuildArch:      noarch
+
+%description zsh-completion
+This package contain the zsh completion command for the Bluetooth Stack for Linux.
+
+%prep
+%autosetup -p1
+mkdir dbus-apis
+cp -a doc/*.txt dbus-apis/
+
+# for auto-enable subpackage
+sed -i '/^#AutoEnable=false/aAutoEnable=true' src/main.conf
+
+# 2to3 does not fix the #! line
+sed -i '1s#/usr/bin/python$#/usr/bin/python3#' test/*
+
+%build
+%if 0%{?suse_version} < 1550
+echo 0%{?suse_version}
+export CC=gcc-8
+%endif
+# header file has "#ifndef FIRMWARE_DIR...#define FIRMWARE_DIR /etc/firmare"
+# instead of patching, just supply FIRMWARE_DIR on compiler's command line
+export CPPFLAGS="$CPPFLAGS -DFIRMWARE_DIR='\"%{_firmwaredir}\"'"
+# because of patch4...
+autoreconf -fi
+# --enable-experimental is needed or btattach does not build (bug?)
+%configure \
+	--disable-silent-rules  \
+	--enable-pie		\
+	--enable-library	\
+	--enable-tools		\
+	--enable-cups		\
+	--enable-hid2hci        \
+	--enable-admin		\
+%if %{with mesh}
+	--enable-mesh		\
+%endif
+	--enable-midi		\
+	--enable-test		\
+	--enable-experimental	\
+%if %{with bluez_deprecated}
+	--enable-deprecated	\
+%endif
+	--enable-datafiles	\
+	--enable-sixaxis	\
+	--with-dbusconfdir=%{_datadir}	\
+%if 0%{?suse_version} >= 1550
+	--enable-external-ell	\
+%endif
+	--with-systemdsystemunitdir=%{_unitdir}		\
+	--with-systemduserunitdir=%{_userunitdir}
+
+%make_build all
+
+%install
+%make_install
+find %{buildroot} -type f -name "*.la" -delete -print
+install --mode=0644 -D %{SOURCE7} %{buildroot}/%{_modprobedir}/50-bluetooth.conf
+# no idea why this is suddenly necessary...
+install --mode 0755 -d %{buildroot}%{_localstatedir}/lib/bluetooth
+
+## same as in fedora...
+# "make install" fails to install gatttool, used with Bluetooth Low Energy
+# boo#970628
+%if %{with bluez_deprecated}
+install -m0755 attrib/gatttool %{buildroot}%{_bindir}
+%endif
+
+## install btgatt-client for -test package, see
+## https://www.spinics.net/lists/linux-bluetooth/msg63258.html
+install -m0755 tools/btgatt-client %{buildroot}%{_bindir}
+# btmgmt can be useful
+install -m0755 tools/btmgmt %{buildroot}%{_bindir}
+# avinfo can be useful for debugging
+install -m0755 tools/avinfo %{buildroot}%{_bindir}
+
+# for auto-enable subpackage
+find . -name main.conf
+install --mode 0644 -D src/main.conf %{buildroot}/%{_sysconfdir}/bluetooth/main.conf
+
+# rpmlint warnings...
+cd %{buildroot}%{_libdir}/bluez/test
+chmod 0644 *.py *.xml *.dtd
+
+# fix python shebang
+sed -i -e '1s/env p/p/' %{buildroot}%{_libdir}/bluez/test/{example-gatt-{client,server},test-mesh}
+
+mkdir -p %{buildroot}%{_defaultdocdir}/%{name}
+cp %{SOURCE9} %{buildroot}%{_defaultdocdir}/%{name}
+%if %{with mesh}
+# boo#1151518
+mv %{buildroot}%{_datadir}/dbus-1/system.d/bluetooth-mesh.conf %{buildroot}%{_defaultdocdir}/%{name}
+mv %{buildroot}%{_datadir}/dbus-1/system-services/org.bluez.mesh.service %{buildroot}%{_defaultdocdir}/%{name}
+cat > %{buildroot}%{_defaultdocdir}/%{name}/README-mesh.SUSE << EOF
+The bluetooth-mesh dbus system config has been disabled due to security
+concerns. See https://bugzilla.opensuse.org/show_bug.cgi?id=1151518 for
+details.
+
+If you want to use this feature anyway, copy
+bluetooth-mesh.conf to %{_sysconfdir}/dbus-1/systemd.d/ and
+org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/,
+then reboot.
+EOF
+touch -r %{SOURCE0} %{buildroot}%{_defaultdocdir}/%{name}/README-mesh.SUSE
+%endif
+
+%check
+%if ! 0%{?qemu_user_space_build}
+##make %%{?_smp_mflags} check
+# deliberately not running parallel, as the test suite has spurious failures otherwise
+%make_build check V=0
+%endif
+
+%pre
+%service_add_pre bluetooth.service bluetooth-mesh.service
+# Avoid restoring outdated stuff in posttrans
+for _f in %{?modprobe_d_files}; do
+    [ ! -f "/etc/modprobe.d/${_f}.rpmsave" ] || \
+	mv -f "/etc/modprobe.d/${_f}.rpmsave" "/etc/modprobe.d/${_f}.rpmsave.old" || :
+done
+
+%post
+%{?udev_rules_update:%udev_rules_update}
+# todo: check if this is still obeyed / needed with systemd
+%{fillup_only -n bluetooth}
+# We need the bluez systemd service enabled at any time. It won't start up
+# on its own, as it is triggered by udev in the end (bnc#796671)
+%{_bindir}/systemctl enable bluetooth.service 2>&1 || :
+%{_bindir}/systemctl daemon-reload >/dev/null 2>&1 || :
+
+%preun
+%service_del_preun bluetooth.service bluetooth-mesh.service
+
+%postun
+%service_del_postun bluetooth.service bluetooth-mesh.service
+
+%posttrans
+# Migration of modprobe.conf files to _modprobedir
+for _f in %{?modprobe_d_files}; do
+    [ ! -f "/etc/modprobe.d/${_f}.rpmsave" ] || \
+	mv -fv "/etc/modprobe.d/${_f}.rpmsave" "/etc/modprobe.d/${_f}" || :
+done
+
+%post -n libbluetooth3 -p /sbin/ldconfig
+%postun -n libbluetooth3 -p /sbin/ldconfig
+
+%pre obexd
+%systemd_user_pre obex.service
+
+%post obexd
+%systemd_user_post obex.service
+
+%preun obexd
+%systemd_user_preun obex.service
+
+%postun obexd
+%systemd_user_postun obex.service
+
+%files
+%doc AUTHORS ChangeLog README dbus-apis src/main.conf
+%if %{with mesh}
+%doc %{_defaultdocdir}/%{name}/*
+%endif
+%license COPYING
+%{_bindir}/bluemoon
+%{_bindir}/btattach
+%{_bindir}/btmgmt
+%{_bindir}/l2ping
+%{_bindir}/hex2hcd
+%{_bindir}/isotest
+%{_bindir}/mpris-proxy
+%dir %{_libdir}/bluetooth
+%dir %{_libdir}/bluetooth/plugins
+%{_libdir}/bluetooth/plugins/sixaxis.so
+%dir %{_libexecdir}/bluetooth
+%{_libexecdir}/bluetooth/bluetoothd
+%if %{with mesh}
+%{_libexecdir}/bluetooth/bluetooth-meshd
+%{_bindir}/mesh-cfgtest
+%{_mandir}/man8/bluetooth-meshd.8%{?ext_man}
+%endif
+%{_bindir}/bluetoothctl
+%{_bindir}/btmon
+%if %{with mesh}
+%{_bindir}/meshctl
+%{_bindir}/mesh-cfgclient
+%endif
+%{_prefix}/lib/udev/
+%{_mandir}/man1/btattach.1%{?ext_man}
+%{_mandir}/man1/btmon.1%{?ext_man}
+%{_mandir}/man1/isotest.1%{?ext_man}
+%{_mandir}/man8/bluetoothd.8%{?ext_man}
+%{_mandir}/man1/hid2hci.1%{?ext_man}
+%{_mandir}/man1/l2ping.1%{?ext_man}
+%{_mandir}/man1/rctest.1%{?ext_man}
+%{_mandir}/man1/bluetoothctl-mgmt.1%{?ext_man}
+%{_mandir}/man1/bluetoothctl-monitor.1%{?ext_man}
+%{_mandir}/man1/btmgmt.1%{?ext_man}
+%{_datadir}/dbus-1/system.d/bluetooth.conf
+# not packaged, boo#1151518
+###%%{_datadir}/dbus-1/system.d/bluetooth-mesh.conf
+%dir %{_localstatedir}/lib/bluetooth
+%dir %{_modprobedir}
+%{_modprobedir}/50-bluetooth.conf
+%{_unitdir}/bluetooth.service
+%if %{with mesh}
+%{_unitdir}/bluetooth-mesh.service
+%endif
+%{_datadir}/dbus-1/system-services/org.bluez.service
+# not packaged, boo#1151518
+###%%{_datadir}/dbus-1/system-services/org.bluez.mesh.service
+
+%files obexd
+%{_libexecdir}/bluetooth/obexd
+%{_datadir}/dbus-1/services/org.bluez.obex.service
+%{_userunitdir}/obex.service
+
+%if %{with bluez_deprecated}
+%files deprecated
+%{_bindir}/gatttool
+%{_bindir}/hcitool
+%{_bindir}/rfcomm
+%{_bindir}/sdptool
+%{_bindir}/ciptool
+%{_bindir}/hciattach
+%{_bindir}/hciconfig
+%{_bindir}/hcidump
+%{_mandir}/man1/hcidump.1%{?ext_man}
+%{_mandir}/man1/hciattach.1%{?ext_man}
+%{_mandir}/man1/hciconfig.1%{?ext_man}
+%{_mandir}/man1/hcitool.1%{?ext_man}
+%{_mandir}/man1/sdptool.1%{?ext_man}
+%{_mandir}/man1/ciptool.1%{?ext_man}
+%{_mandir}/man1/rfcomm.1%{?ext_man}
+%endif
+
+%files devel
+%{_includedir}/bluetooth
+%{_libdir}/libbluetooth.so
+%{_libdir}/pkgconfig/bluez.pc
+
+%files -n libbluetooth3
+%{_libdir}/libbluetooth.so.*
+%doc AUTHORS ChangeLog README
+%license COPYING
+
+%files cups
+%dir %{_prefix}/lib/cups
+%dir %{_prefix}/lib/cups/backend
+%{_prefix}/lib/cups/backend/bluetooth
+
+%files test
+%{_bindir}/avinfo
+#{_bindir}/hciemu
+%{_bindir}/l2test
+%{_bindir}/rctest
+%{_bindir}/btgatt-client
+%dir %{_libdir}/bluez
+%{_libdir}/bluez/test
+
+%files auto-enable-devices
+%dir %{_sysconfdir}/bluetooth
+%config(noreplace) %{_sysconfdir}/bluetooth/main.conf
+
+%files zsh-completion
+%{_datadir}/zsh/site-functions/_bluetoothctl
+
+%changelog

disable_some_obex_tests.patch

@@ -0,0 +1,28 @@
+From: Michel Normand <normand@linux.vnet.ibm.com>
+Subject: disable some obex tests
+Date: Tue, 30 Jan 2018 17:01:45 +0100
+
+disable some obex tests as transient failures
+reported by bug
+https://bugzilla.suse.com/show_bug.cgi?id=1078285
+
+Signed-off-by: Michel Normand <normand@linux.vnet.ibm.com>
+---
+ Makefile.am | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+Index: bluez-5.65/Makefile.am
+===================================================================
+--- bluez-5.65.orig/Makefile.am
++++ bluez-5.65/Makefile.am
+@@ -502,8 +502,8 @@ unit_test_gdbus_client_LDADD = gdbus/lib
+ 				src/libshared-glib.la $(GLIB_LIBS) $(DBUS_LIBS)
+ 
+ if OBEX
+-unit_tests += unit/test-gobex-header unit/test-gobex-packet unit/test-gobex \
+-			unit/test-gobex-transfer unit/test-gobex-apparam
++unit_tests += unit/test-gobex-header unit/test-gobex-packet \
++			unit/test-gobex-apparam
+ 
+ unit_test_gobex_SOURCES = $(gobex_sources) unit/util.c unit/util.h \
+ 						unit/test-gobex.c

hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch

@@ -0,0 +1,159 @@
+From 08a69d36726b6345df6e64892cadd5ab5d5ca2a6 Mon Sep 17 00:00:00 2001
+From: "Cho, Yu-Chen" <acho@suse.com>
+Date: Tue, 19 Mar 2019 15:54:09 +0800
+Subject: [PATCH BlueZ] hcidump: Add assoc dump function assoc date length check
+
+amp_assoc_dump() didn't check the length of amp assoc struct.
+If there is wrong length size of assoc date, amp_assoc_dump() and
+amp_dump_chanlist() will read over the size(heap-buffer-overflow).
+
+use t_len to save the length avoid use the wrong size of date.
+---
+ tools/parser/amp.c    | 35 +++++++++++++++++++++++++++--------
+ tools/parser/hci.c    |  4 ++--
+ tools/parser/l2cap.c  |  6 ++++--
+ tools/parser/parser.h |  2 +-
+ 4 files changed, 34 insertions(+), 13 deletions(-)
+
+Index: bluez-5.65/tools/parser/amp.c
+===================================================================
+--- bluez-5.65.orig/tools/parser/amp.c
++++ bluez-5.65/tools/parser/amp.c
+@@ -15,7 +15,8 @@
+ #include "parser.h"
+ #include "lib/amp.h"
+ 
+-static void amp_dump_chanlist(int level, struct amp_tlv *tlv, char *prefix)
++static void amp_dump_chanlist(int level, struct amp_tlv *tlv,
++			      uint16_t t_len, char *prefix)
+ {
+ 	struct amp_chan_list *chan_list = (void *) tlv->val;
+ 	struct amp_country_triplet *triplet;
+@@ -25,6 +26,12 @@ static void amp_dump_chanlist(int level,
+ 
+ 	printf("%s (number of triplets %d)\n", prefix, num);
+ 
++	if (btohs(tlv->len) > t_len) {
++		p_indent(level+1, 0);
++		printf("Wrong number of triplets\n");
++		num = (t_len - sizeof(*chan_list)) / sizeof(*triplet);
++	}
++
+ 	p_indent(level+2, 0);
+ 
+ 	printf("Country code: %c%c%c\n", chan_list->country_code[0],
+@@ -55,7 +62,7 @@ static void amp_dump_chanlist(int level,
+ 	}
+ }
+ 
+-void amp_assoc_dump(int level, uint8_t *assoc, uint16_t len)
++void amp_assoc_dump(int level, uint8_t *assoc, uint16_t len, uint16_t t_len)
+ {
+ 	struct amp_tlv *tlv = (void *) assoc;
+ 
+@@ -63,6 +70,14 @@ void amp_assoc_dump(int level, uint8_t *
+ 	printf("Assoc data [len %d]:\n", len);
+ 
+ 	while (len > sizeof(*tlv)) {
++		if (btohs(tlv->len) > (t_len - sizeof(struct amp_tlv))) {
++			p_indent(level+1, 0);
++			printf("Assoc data get error size\n");
++			t_len -= sizeof(struct amp_tlv);
++		} else {
++			t_len -= sizeof(struct amp_tlv) + btohs(tlv->len);
++		}
++
+ 		uint16_t tlvlen = btohs(tlv->len);
+ 		struct amp_pal_ver *ver;
+ 
+@@ -78,11 +93,13 @@ void amp_assoc_dump(int level, uint8_t *
+ 			break;
+ 
+ 		case A2MP_PREF_CHANLIST_TYPE:
+-			amp_dump_chanlist(level, tlv, "Preferred Chan List");
++			amp_dump_chanlist(level, tlv,
++					  t_len, "Preferred Chan List");
+ 			break;
+ 
+ 		case A2MP_CONNECTED_CHAN:
+-			amp_dump_chanlist(level, tlv, "Connected Chan List");
++			amp_dump_chanlist(level, tlv,
++					  t_len, "Connected Chan List");
+ 			break;
+ 
+ 		case A2MP_PAL_CAP_TYPE:
+@@ -106,9 +123,11 @@ void amp_assoc_dump(int level, uint8_t *
+ 			printf("Unrecognized type %d\n", tlv->type);
+ 			break;
+ 		}
+-
+-		len -= tlvlen + sizeof(*tlv);
+-		assoc += tlvlen + sizeof(*tlv);
+-		tlv = (struct amp_tlv *) assoc;
++		if (btohs(tlv->len) <= t_len) {
++			len -= tlvlen + sizeof(*tlv);
++			assoc += tlvlen + sizeof(*tlv);
++			tlv = (struct amp_tlv *) assoc;
++		} else
++			len = 0;
+ 	}
+ }
+Index: bluez-5.65/tools/parser/hci.c
+===================================================================
+--- bluez-5.65.orig/tools/parser/hci.c
++++ bluez-5.65/tools/parser/hci.c
+@@ -1667,7 +1667,7 @@ static inline void write_remote_amp_asso
+ 	printf("handle 0x%2.2x len_so_far %d remaining_len %d\n", cp->handle,
+ 				cp->length_so_far, cp->remaining_length);
+ 
+-	amp_assoc_dump(level + 1, cp->fragment, frm->len - 5);
++	amp_assoc_dump(level + 1, cp->fragment, frm->len - 5, frm->len - 5);
+ }
+ 
+ static inline void command_dump(int level, struct frame *frm)
+@@ -2650,7 +2650,7 @@ static inline void read_local_amp_assoc_
+ 		p_indent(level, frm);
+ 		printf("Error: %s\n", status2str(rp->status));
+ 	} else {
+-		amp_assoc_dump(level + 1, rp->fragment, len);
++		amp_assoc_dump(level + 1, rp->fragment, len, frm->len - 4);
+ 	}
+ }
+ 
+Index: bluez-5.65/tools/parser/l2cap.c
+===================================================================
+--- bluez-5.65.orig/tools/parser/l2cap.c
++++ bluez-5.65/tools/parser/l2cap.c
+@@ -1159,7 +1159,8 @@ static inline void a2mp_assoc_rsp(int le
+ 
+ 	printf("Get AMP Assoc rsp: id %d status (%d) %s\n",
+ 			h->id, h->status, a2mpstatus2str(h->status));
+-	amp_assoc_dump(level + 1, h->assoc_data, len - sizeof(*h));
++	amp_assoc_dump(level + 1, h->assoc_data,
++		       len - sizeof(*h), frm->len - sizeof(*h));
+ }
+ 
+ static inline void a2mp_create_req(int level, struct frame *frm, uint16_t len)
+@@ -1168,7 +1169,8 @@ static inline void a2mp_create_req(int l
+ 
+ 	printf("Create Physical Link req: local id %d remote id %d\n",
+ 		   h->local_id, h->remote_id);
+-	amp_assoc_dump(level + 1, h->assoc_data, len - sizeof(*h));
++	amp_assoc_dump(level + 1, h->assoc_data,
++		       len - sizeof(*h), frm->len - sizeof(*h));
+ }
+ 
+ static inline void a2mp_create_rsp(int level, struct frame *frm)
+Index: bluez-5.65/tools/parser/parser.h
+===================================================================
+--- bluez-5.65.orig/tools/parser/parser.h
++++ bluez-5.65/tools/parser/parser.h
+@@ -236,7 +236,7 @@ void ericsson_dump(int level, struct fra
+ void csr_dump(int level, struct frame *frm);
+ void bpa_dump(int level, struct frame *frm);
+ 
+-void amp_assoc_dump(int level, uint8_t *assoc, uint16_t len);
++void amp_assoc_dump(int level, uint8_t *assoc, uint16_t len, uint16_t t_len);
+ 
+ static inline void parse(struct frame *frm)
+ {

hcidump-Fix-memory-leak-with-malformed-packet.patch

@@ -0,0 +1,33 @@
+From 98bee47cca1b8a6b17bb0178f951fe7902abc2f0 Mon Sep 17 00:00:00 2001
+From: "Cho, Yu-Chen" <acho@suse.com>
+Date: Wed, 24 Apr 2019 16:10:56 +0800
+Subject: [PATCH BlueZ] tool/hcidump: Fix memory leak with malformed packet
+
+Do not allow to read more than allocated data buffer size.
+Because of the buffer is malloc(HCI_MAX_FRAME_SIZE),
+so there is heap buffer overflow if read the size more than
+HCI_MAX_FRAME_SIZE and fd size is larger than HCI_MAX_FRAME_SIZE.
+---
+ tools/hcidump.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+Index: bluez-5.60/tools/hcidump.c
+===================================================================
+--- bluez-5.60.orig/tools/hcidump.c
++++ bluez-5.60/tools/hcidump.c
+@@ -92,6 +92,15 @@ struct pktlog_hdr {
+ static inline int read_n(int fd, char *buf, int len)
+ {
+ 	int t = 0, w;
++	off_t fsize, currentpos, startpos;
++
++	currentpos = lseek(fd, 0, SEEK_CUR);
++	fsize = lseek(fd, 0, SEEK_END);
++	lseek(fd, currentpos, SEEK_SET);
++	fsize -= currentpos;
++
++	if (fsize > HCI_MAX_FRAME_SIZE && len > HCI_MAX_FRAME_SIZE)
++		return -1;
+ 
+ 	while (len > 0) {
+ 		if ((w = read(fd, buf, len)) < 0) {

hcidump-Fixed-malformed-segment-frame-length.patch

@@ -0,0 +1,26 @@
+From da04ba5e6b3f151c1644a17ac0fa2317ebc81edd Mon Sep 17 00:00:00 2001
+From: "Cho, Yu-Chen" <acho@suse.com>
+Date: Tue, 15 Oct 2019 15:45:43 +0800
+Subject: [PATCH] hcidump: Fixed malformed segment frame length
+
+Ensure the L2CAP SDUs whose length field match the actual frame length.
+---
+ tools/parser/l2cap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+Index: bluez-5.60/tools/parser/l2cap.c
+===================================================================
+--- bluez-5.60.orig/tools/parser/l2cap.c
++++ bluez-5.60/tools/parser/l2cap.c
+@@ -759,6 +759,11 @@ static inline void conf_rsp(int level, l
+ 			scid, btohs(h->flags), result, clen);
+ 
+ 	if (clen > 0) {
++	        if (clen != (btohs(frm->len) - L2CAP_CONF_RSP_SIZE)) {
++			fprintf(stderr, "Not match the actual frame length\n");
++			clen = btohs(frm->len) - L2CAP_CONF_RSP_SIZE;
++		}
++
+ 		if (result) {
+ 			p_indent(level + 1, frm);
+ 			printf("%s\n", confresult2str(result));