3 files changed, 57 insertions, 2 deletions

diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index 13fd600296..529d5a66f7 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -18,6 +18,7 @@ PACKAGECONFIG[experimental] = "--enable-experimental,--disable-experimental,"
 
 SRC_URI = "\
     ${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
+    file://core-profile-Fix-possible-crash-when-registering-pro.patch \
     file://init \
 "
 S = "${WORKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/core-profile-Fix-possible-crash-when-registering-pro.patch b/meta/recipes-connectivity/bluez5/bluez5/core-profile-Fix-possible-crash-when-registering-pro.patch
new file mode 100644
index 0000000000..5c6cee1cff
--- /dev/null
+++ b/meta/recipes-connectivity/bluez5/bluez5/core-profile-Fix-possible-crash-when-registering-pro.patch
@@ -0,0 +1,54 @@
+From bc4dbda3362d3654447d8ae6525cac1540b7d705 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Thu, 5 Nov 2015 15:14:50 +0200
+Subject: [PATCH] core/profile: Fix possible crash when registering profiles
+
+Upstream-Status: Backport
+
+Profiles under ext_profiles are local and should no be mixed with other
+external profiles since its type is different which can may cause invalid
+memory when accessing member of ext_profile struct.
+---
+ src/profile.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/src/profile.c b/src/profile.c
+index 49445d7..5a4f09c 100644
+--- a/src/profile.c
++++ b/src/profile.c
+@@ -719,19 +719,13 @@ void btd_profile_foreach(void (*func)(struct btd_profile *p, void *data),
+ 
+ int btd_profile_register(struct btd_profile *profile)
+ {
+-       if (profile->external)
+-               ext_profiles = g_slist_append(ext_profiles, profile);
+-       else
+-               profiles = g_slist_append(profiles, profile);
++       profiles = g_slist_append(profiles, profile);
+        return 0;
+ }
+ 
+ void btd_profile_unregister(struct btd_profile *profile)
+ {
+-       if (profile->external)
+-               ext_profiles = g_slist_remove(ext_profiles, profile);
+-       else
+-               profiles = g_slist_remove(profiles, profile);
++       profiles = g_slist_remove(profiles, profile);
+ }
+ 
+ static struct ext_profile *find_ext_profile(const char *owner,
+@@ -742,10 +736,6 @@ static struct ext_profile *find_ext_profile(const char *owner,
+        for (l = ext_profiles; l != NULL; l = g_slist_next(l)) {
+                struct ext_profile *ext = l->data;
+ 
+-               /*
+-                * Owner and path can be NULL if profile was registered by a
+-                * plugin using external flag.
+-                */
+                if (g_strcmp0(ext->owner, owner))
+                        continue;
+ 
+-- 
+2.5.0
+
diff --git a/meta/recipes-connectivity/bluez5/bluez5_5.33.bb b/meta/recipes-connectivity/bluez5/bluez5_5.36.bb
index 23c7397e16..b94ed31def 100644
--- a/meta/recipes-connectivity/bluez5/bluez5_5.33.bb
+++ b/meta/recipes-connectivity/bluez5/bluez5_5.36.bb
@@ -1,6 +1,6 @@
 require bluez5.inc
-SRC_URI[md5sum] = "78782dc33d9a8b6344c4cc1af70c8a98"
-SRC_URI[sha256sum] = "1801807a13506678cbfeb15c6a4b89ecb5739efe1067eb464da6641d731436d3"
+SRC_URI[md5sum] = "9a0ee479cacc44fac68f6a65b1cd3eba"
+SRC_URI[sha256sum] = "a343ea1aeb53d3bd139087f3b1c1e1fb70db452d9762cc7a3d23e75962e578f2"
 
 # noinst programs in Makefile.tools that are conditional on READLINE
 # support