Why does an error occur when the uuid filter is not passed to the binc_adapter_set_discovery_filter interface?

[w544503507]

When I tried to scan for devices using the new version of binc, I wanted to filter devices by manufacturer ID instead of UUID. So I called the filter interface like this:
binc_adapter_set_discovery_filter(m_pDefaultAdapter, -100, NULL, NULL);binc_adapter_start_discovery(m_pDefaultAdapter);
Thread 1 "utcl" received signal SIGSEGV, Segmentation fault.

0x0000007ff7694c1c in g_variant_iter_loop () from /usr/lib/libglib-2.0.so.0
(gdb) bt
#0 0x0000007ff7694c1c in g_variant_iter_loop () from /usr/lib/libglib-2.0.so.0
#1 0x0000007ff75e695c in binc_internal_device_update_property () from /usr/lib/bluetooth/libbinc.so.0
#2 0x0000007ff75dbd40 in binc_adapter_find_all () from /usr/lib/bluetooth/libbinc.so.0
#3 0x0000007ff75dbe38 in binc_adapter_get_default () from /usr/lib/bluetooth/libbinc.so.0
#4 0x0000000000417fc8 in utcl::BLEMaster::init() ()
#5 0x00000000004136cc in utcl::CBlueToothChannel::init(utcl::CConfig const*) ()
#6 0x0000000000467e68 in utcl::CSession::init(utcl::CConfig const*) ()
#7 0x00000000004693c0 in testBlueToothClient(int) ()
#8 0x00000000004128fc in main ()

When I pass a filtered UUID in the third parameter, there is no segmentation fault.
I also tried calling it this way in the old 2023 version of the binc library I used before, and no such segmentation fault occurred. May I ask if there is a way to not filter UUIDs in the latest version of the library? Could this segmentation fault be a bug?
I want to read the broadcast manufacturer data and parse it to filter devices myself. Is this filtering method in line with normal application scenarios? How do other products usually filter devices?
I look forward to your reply very much. Thank you.

[weliem]

I cannot reproduce this issue. Please share some relevant code describe how I can reproduce the crash.

[weliem]

The error trace suggests that there is an issue in parsing the manufacturer data. What is in the manufacturer data of the device you are scanning for?

[w544503507]

This is the crash log after I modified your demo by changing the UUID filter to NULL. The demo hasn't called the interface for obtaining device manufacturer information yet. Since the UUID filter is set to NULL, it can scan all nearby devices, so I can't provide information on which specific device triggered the crash when scanned.**

warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available.
[New LWP 12286]
[New LWP 12287]
[New LWP 12288]
2025-10-22 09:32:15:033 DEBUG [Adapter] finding adapters
2025-10-22 09:32:15:037 DEBUG [Adapter] found adapter '/org/bluez/hci0'
2025-10-22 09:32:15:037 DEBUG [Adapter] found 1 adapter
2025-10-22 09:32:15:037 INFO [Main] using adapter 'hci0'
start_scanning11111111
2025-10-22 09:32:15:041 DEBUG [Main] discovery 'starting' (/org/bluez/hci0)
2025-10-22 09:32:15:044 DEBUG [Main] discovery 'started' (/org/bluez/hci0)

(process:12284): GLib-CRITICAL **: 09:32:15.051: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.051: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.051: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:32:15:051 DEBUG [Main] Device{name='(null)', address='28:C8:D6:69:0B:D4', address_type=random, rssi=-74, uuids=[, manufacturer_data=[0006 -> 01092002e1d2d913bea3449757d6b3e1e10c83fefcd1013a600f04, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_28_C8_D6_69_0B_D4' }
2025-10-22 09:32:15:051 DEBUG [Device] Connecting to '(null)' (28:C8:D6:69:0B:D4) (BINC_BOND_NONE)
2025-10-22 09:32:15:052 DEBUG [Main] '(null)' (28:C8:D6:69:0B:D4) state: CONNECTING (2)

(process:12284): GLib-CRITICAL **: 09:32:15.063: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.063: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.063: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:32:15:063 DEBUG [Main] Device{name='(null)', address='24:DF:5D:8E:58:3C', address_type=random, rssi=-93, uuids=[, manufacturer_data=[0006 -> 01092022f547b5108b4dce800b1f5f6c086467901cc941307b56fc, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_24_DF_5D_8E_58_3C' }
2025-10-22 09:32:15:063 DEBUG [Device] Connecting to '(null)' (24:DF:5D:8E:58:3C) (BINC_BOND_NONE)
2025-10-22 09:32:15:063 DEBUG [Main] '(null)' (24:DF:5D:8E:58:3C) state: CONNECTING (2)

(process:12284): GLib-CRITICAL **: 09:32:15.070: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.070: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.070: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:32:15:070 DEBUG [Main] Device{name='(null)', address='28:DE:7B:D7:B7:11', address_type=random, rssi=-95, uuids=[, manufacturer_data=[0006 -> 0109202237e82cd0c28558b8d2ffff01994d415407f087365f1ff7, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_28_DE_7B_D7_B7_11' }
2025-10-22 09:32:15:070 DEBUG [Device] Connecting to '(null)' (28:DE:7B:D7:B7:11) (BINC_BOND_NONE)
2025-10-22 09:32:15:070 DEBUG [Main] '(null)' (28:DE:7B:D7:B7:11) state: CONNECTING (2)

(process:12284): GLib-CRITICAL **: 09:32:15.106: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.106: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12284): GLib-CRITICAL **: 09:32:15.106: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:32:15:106 DEBUG [Main] Device{name='(null)', address='1C:B9:E9:F9:4F:2B', address_type=random, rssi=-90, uuids=[, manufacturer_data=[0006 -> 010920223b7cc4aeb882b2a124c7120f2569dea8264516fcf10726, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_1C_B9_E9_F9_4F_2B' }
2025-10-22 09:32:15:106 DEBUG [Device] Connecting to '(null)' (1C:B9:E9:F9:4F:2B) (BINC_BOND_NONE)
2025-10-22 09:32:15:106 DEBUG [Main] '(null)' (1C:B9:E9:F9:4F:2B) state: CONNECTING (2)

Thread 1 "BLEMaster" received signal SIGSEGV, Segmentation fault.
0x0000007ff7cacc1c in g_variant_iter_loop () from /usr/lib/bluetooth/libglib-2.0.so.0
(gdb) bt
#0 0x0000007ff7cacc1c in g_variant_iter_loop () from /usr/lib/bluetooth/libglib-2.0.so.0
#1 0x00000000004158f8 in binc_internal_device_update_property ()
#2 0x0000000000408aac in binc_internal_device_appeared ()
#3 0x0000007ff7e4ca00 in ?? () from /usr/lib/bluetooth/libgio-2.0.so.0
#4 0x0000007ff7c6f7e4 in g_main_context_dispatch () from /usr/lib/bluetooth/libglib-2.0.so.0
#5 0x0000007ff7c6fa48 in ?? () from /usr/lib/bluetooth/libglib-2.0.so.0
#6 0x0000007ff7c6fe80 in g_main_loop_run () from /usr/lib/bluetooth/libglib-2.0.so.0
#7 0x000000000040795c in main ()
(gdb)

The following is the code I'm using to reproduce the issue, modified from your demo. I've tried BlueZ versions 5.79 and 5.68. Also, I've confirmed that it doesn't crash with the 2023 version of binc. Thank you very much for your help—this is the only issue I've encountered after updating to the latest version.

The progress the program can reach isn't consistent each time I run it. On the second run, it crashed here:

root@rk3566_emmc:/usr/local# ./BLEMaster
2025-10-22 09:37:48:167 DEBUG [Adapter] finding adapters
2025-10-22 09:37:48:179 DEBUG [Adapter] found adapter '/org/bluez/hci0'
2025-10-22 09:37:48:180 DEBUG [Adapter] found device /org/bluez/hci0/dev_00_00_00_00_00_00 '(null)'
2025-10-22 09:37:48:180 DEBUG [Adapter] found device /org/bluez/hci0/dev_79_5C_10_7F_E9_97 'iPhone'
Segmentation fault (core dumped)

The following is the log from the third run:

root@rk3566_emmc:/usr/local# ./BLEMaster
2025-10-22 09:38:37:494 DEBUG [Adapter] finding adapters
2025-10-22 09:38:37:497 DEBUG [Adapter] found adapter '/org/bluez/hci0'
2025-10-22 09:38:37:497 DEBUG [Adapter] found 1 adapter
2025-10-22 09:38:37:497 INFO [Main] using adapter 'hci0'
start_scanning11111111
2025-10-22 09:38:37:501 DEBUG [Main] discovery 'starting' (/org/bluez/hci0)
2025-10-22 09:38:37:504 DEBUG [Main] discovery 'started' (/org/bluez/hci0)

(process:12561): GLib-CRITICAL **: 09:38:37.558: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12561): GLib-CRITICAL **: 09:38:37.558: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12561): GLib-CRITICAL **: 09:38:37.558: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:38:37:558 DEBUG [Main] Device{name='(null)', address='2F:65:88:BF:5E:39', address_type=random, rssi=-85, uuids=[, manufacturer_data=[0006 -> 01092002254650d6dfe1109217b132c5c4efd4f1abfad0b2ce0df8, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_2F_65_88_BF_5E_39' }
2025-10-22 09:38:37:558 DEBUG [Device] Connecting to '(null)' (2F:65:88:BF:5E:39) (BINC_BOND_NONE)
2025-10-22 09:38:37:558 DEBUG [Main] '(null)' (2F:65:88:BF:5E:39) state: CONNECTING (2)

(process:12561): GLib-CRITICAL **: 09:38:37.575: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12561): GLib-CRITICAL **: 09:38:37.576: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12561): GLib-CRITICAL **: 09:38:37.576: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:38:37:576 DEBUG [Main] Device{name='(null)', address='35:8C:FB:04:19:50', address_type=random, rssi=-90, uuids=[, manufacturer_data=[0006 -> 01092022e0d76e83d5e5e2154f96b15166249d7740e84ad19e69bd, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_35_8C_FB_04_19_50' }
2025-10-22 09:38:37:576 DEBUG [Device] Connecting to '(null)' (35:8C:FB:04:19:50) (BINC_BOND_NONE)
2025-10-22 09:38:37:576 DEBUG [Main] '(null)' (35:8C:FB:04:19:50) state: CONNECTING (2)

(process:12561): GLib-CRITICAL **: 09:38:37.738: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12561): GLib-CRITICAL **: 09:38:37.738: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed

(process:12561): GLib-CRITICAL **: 09:38:37.738: g_string_insert_len: assertion 'pos_unsigned <= string->len' failed
2025-10-22 09:38:37:738 DEBUG [Main] Device{name='(null)', address='00:00:00:00:00:00', address_type=random, rssi=-82, uuids=[, manufacturer_data=[, service_data=[, paired=false, txpower=-255 path='/org/bluez/hci0/dev_00_00_00_00_00_00' }
2025-10-22 09:38:37:738 DEBUG [Device] Connecting to '(null)' (00:00:00:00:00:00) (BINC_BOND_NONE)
2025-10-22 09:38:37:738 DEBUG [Main] '(null)' (00:00:00:00:00:00) state: CONNECTING (2)
Segmentation fault (core dumped)

The function that crashes every time is this one.

0x0000007ff7cacc1c in g_variant_iter_loop () from /usr/lib/bluetooth/libglib-2.0.so.0
(gdb) bt
#0 0x0000007ff7cacc1c in g_variant_iter_loop () from /usr/lib/bluetooth/libglib-2.0.so.0
#1 0x00000000004158f8 in binc_internal_device_update_property ()
#2 0x0000000000409c64 in binc_adapter_find_all ()
#3 0x0000000000409d48 in binc_adapter_get_default ()
#4 0x00000000004078b0 in main ()

[w544503507]

This is the code I modified based on your demo, with the main change being setting the UUID parameter to NULL.

#include
#include <glib.h>
#include <stdio.h>
#include <signal.h>
#include "binc/adapter.h"
#include "binc/device.h"
#include "binc/logger.h"
#include "binc/agent.h"
#include "binc/parser.h"

#include <glib.h>
#include <stdio.h>
#include <signal.h>
#include "binc/adapter.h"
#include "binc/device.h"
#include "binc/logger.h"
#include "binc/agent.h"
#include "binc/parser.h"

#define TAG "Main"
#define HTS_SERVICE_UUID "00001809-0000-1000-8000-00805f9b34fb"
#define TEMPERATURE_CHAR_UUID "00002a1c-0000-1000-8000-00805f9b34fb"
#define DIS_SERVICE "0000180a-0000-1000-8000-00805f9b34fb"
#define DIS_MANUFACTURER_CHAR "00002a29-0000-1000-8000-00805f9b34fb"
#define DIS_MODEL_CHAR "00002a24-0000-1000-8000-00805f9b34fb"
#define CUD_CHAR "00002901-0000-1000-8000-00805f9b34fb"

GMainLoop *loop = NULL;
Adapter *default_adapter = NULL;
Agent *agent = NULL;

void on_connection_state_changed(Device *device, ConnectionState state, const GError *error) {
if (error != NULL) {
log_debug(TAG, "(dis)connect failed (error %d: %s)", error->code, error->message);
return;
}

 log_debug(TAG, "'%s' (%s) state: %s (%d)", binc_device_get_name(device), binc_device_get_address(device),
           binc_device_get_connection_state_name(device), state);

 if (state == BINC_DISCONNECTED) {
     // Remove devices immediately of they are not bonded
     if (binc_device_get_bonding_state(device) != BINC_BONDED) {
         binc_adapter_remove_device(default_adapter, device);
     }
 }

}

void on_bonding_state_changed(Device *device, BondingState new_state, BondingState old_state, const GError *error) {
log_debug(TAG, "bonding state changed from %d to %d", old_state, new_state);
}

void on_notification_state_changed(Device *device, Characteristic *characteristic, const GError *error) {
const char *uuid = binc_characteristic_get_uuid(characteristic);

 if (error != NULL) {
     log_debug(TAG, "notifying <%s> failed (error %d: %s)", uuid, error->code, error->message);
     return;
 }

 log_debug(TAG, "<%s> notifying %s", uuid, binc_characteristic_is_notifying(characteristic) ? "true" : "false");

}

void on_notify(Device *device, Characteristic *characteristic, const GByteArray *byteArray) {
const char *uuid = binc_characteristic_get_uuid(characteristic);
Parser *parser = parser_create(byteArray, LITTLE_ENDIAN);
parser_set_offset(parser, 1);
if (g_str_equal(uuid, TEMPERATURE_CHAR_UUID)) {
double temperature = parser_get_float(parser);
log_debug(TAG, "temperature %.1f", temperature);
}
parser_free(parser);
}

void on_read(Device *device, Characteristic *characteristic, const GByteArray *byteArray, const GError *error) {
const char *uuid = binc_characteristic_get_uuid(characteristic);
if (error != NULL) {
log_debug(TAG, "failed to read '%s' (error %d: %s)", uuid, error->code, error->message);
return;
}

 if (byteArray == NULL) return;

 Parser *parser = parser_create(byteArray, LITTLE_ENDIAN);
 if (g_str_equal(uuid, DIS_MANUFACTURER_CHAR)) {
     GString *manufacturer = parser_get_string(parser);
     log_debug(TAG, "manufacturer = %s", manufacturer->str);
     g_string_free(manufacturer, TRUE);
 } else if (g_str_equal(uuid, DIS_MODEL_CHAR)) {
     GString *model = parser_get_string(parser);
     log_debug(TAG, "model = %s", model->str);
     g_string_free(model, TRUE);
 }
 parser_free(parser);

}

void on_write(Device *device, Characteristic *characteristic, const GByteArray *byteArray, const GError *error) {
log_debug(TAG, "on write");
}

void on_desc_read(Device *device, Descriptor *descriptor, const GByteArray *byteArray, const GError *error) {
log_debug(TAG, "on descriptor read");
Parser *parser = parser_create(byteArray, LITTLE_ENDIAN);
GString *parsed_string = parser_get_string(parser);
log_debug(TAG, "CUD %s", parsed_string->str);
parser_free(parser);
}

void on_services_resolved(Device *device) {
log_debug(TAG, "'%s' services resolved", binc_device_get_name(device));

 binc_device_read_char(device, DIS_SERVICE, DIS_MANUFACTURER_CHAR);
 binc_device_read_char(device, DIS_SERVICE, DIS_MODEL_CHAR);
 binc_device_start_notify(device, HTS_SERVICE_UUID, TEMPERATURE_CHAR_UUID);
 binc_device_read_desc(device, HTS_SERVICE_UUID, TEMPERATURE_CHAR_UUID, CUD_CHAR);

}

gboolean on_request_authorization(Device *device) {
log_debug(TAG, "requesting authorization for '%s", binc_device_get_name(device));
return TRUE;
}

guint32 on_request_passkey(Device *device) {
guint32 pass = 000000;
log_debug(TAG, "requesting passkey for '%s", binc_device_get_name(device));
log_debug(TAG, "Enter 6 digit pin code: ");
int result = fscanf(stdin, "%d", &pass);
if (result != 1) {
log_debug(TAG, "didn't read a pin code");
}
return pass;
}

void on_scan_result(Adapter *adapter, Device *device) {
char *deviceToString = binc_device_to_string(device);
log_debug(TAG, deviceToString);
g_free(deviceToString);

 binc_device_set_connection_state_change_cb(device, &on_connection_state_changed);
 binc_device_set_services_resolved_cb(device, &on_services_resolved);
 binc_device_set_bonding_state_changed_cb(device, &on_bonding_state_changed);
 binc_device_set_read_char_cb(device, &on_read);
 binc_device_set_write_char_cb(device, &on_write);
 binc_device_set_notify_char_cb(device, &on_notify);
 binc_device_set_notify_state_cb(device, &on_notification_state_changed);
 binc_device_set_read_desc_cb(device, &on_desc_read);
 binc_device_connect(device);

}

void on_discovery_state_changed(Adapter *adapter, DiscoveryState state, const GError *error) {
if (error != NULL) {
log_debug(TAG, "discovery error (error %d: %s)", error->code, error->message);
return;
}
log_debug(TAG, "discovery '%s' (%s)", binc_adapter_get_discovery_state_name(adapter),
binc_adapter_get_path(adapter));
}

void start_scanning(Adapter *adapter) {
// GPtrArray *service_uuids = g_ptr_array_new();
// g_ptr_array_add(service_uuids, g_strdup(HTS_SERVICE_UUID));

binc_adapter_set_discovery_cb(adapter, &on_scan_result);
binc_adapter_set_discovery_state_cb(adapter, &on_discovery_state_changed);
binc_adapter_set_discovery_filter(adapter, -100, NULL, NULL);

// g_ptr_array_foreach(service_uuids, (GFunc)g_free, NULL);
// g_ptr_array_free(service_uuids, TRUE);

binc_adapter_start_discovery(default_adapter);

}

void on_powered_state_changed(Adapter *adapter, gboolean state) {
log_debug(TAG, "powered '%s' (%s)", state ? "on" : "off", binc_adapter_get_path(adapter));
if (state) {
start_scanning(default_adapter);
}
}

gboolean callback(gpointer data) {
if (agent != NULL) {
binc_agent_free(agent);
agent = NULL;
}

 if (default_adapter != NULL) {
     binc_adapter_free(default_adapter);
     default_adapter = NULL;
 }

 g_main_loop_quit((GMainLoop *) data);
 return FALSE;

}

static void cleanup_handler(int signo) {
if (signo == SIGINT) {
log_error(TAG, "received SIGINT");
callback(loop);
}
}

int main(void) {
log_enabled(TRUE);
log_set_level(LOG_DEBUG);

 // Get a DBus connection
 GDBusConnection *dbusConnection = g_bus_get_sync(G_BUS_TYPE_SYSTEM, NULL, NULL);

 // Setup signal handler
 if (signal(SIGINT, cleanup_handler) == SIG_ERR)
     log_error(TAG, "can't catch SIGINT");

 // Setup mainloop
 loop = g_main_loop_new(NULL, FALSE);

 // Get the default adapter
 default_adapter = binc_adapter_get_default(dbusConnection);

 if (default_adapter != NULL) {
     log_info(TAG, "using adapter '%s'", binc_adapter_get_name(default_adapter));

     // Register an agent and set callbacks
     agent = binc_agent_create(default_adapter, "/org/bluez/BincAgent", KEYBOARD_DISPLAY);
     binc_agent_set_request_authorization_cb(agent, &on_request_authorization);
     binc_agent_set_request_passkey_cb(agent, &on_request_passkey);

     // Make sure the adapter is on before starting scanning
     binc_adapter_set_powered_state_cb(default_adapter, &on_powered_state_changed);
     if (!binc_adapter_get_powered_state(default_adapter)) {
         binc_adapter_power_on(default_adapter);
     } else {
        printf("start_scanning11111111\r\n");
         start_scanning(default_adapter);
     }
 } else {
     log_error("MAIN", "No default_adapter found");
 }

 // Bail out after some time
 g_timeout_add_seconds(60, callback, loop);

 // Start the mainloop
 g_main_loop_run(loop);

 // Disconnect from DBus
 g_dbus_connection_close_sync(dbusConnection, NULL, NULL);
 g_object_unref(dbusConnection);

 // Clean up mainloop
 g_main_loop_unref(loop);
 return 0;

}

[w544503507]

This is the Bluetooth operation log and scanned devices obtained using btmon before the program crashed. After the program crashed, the scanning continued, but I only copied the device information scanned before the crash.
The core cause of the crash is improper operation of the GVariant iterator, and the root cause may be incorrect parsing of device attribute data or failure to filter invalid data.
Could it be caused by the underlying layer not properly handling this MAC address: Address: 00:00:00:00:00:00 (Non-Resolvable)?

root@rk3566_emmc:~# btmon
Bluetooth monitor ver 5.68
= Note: Linux version 5.10.209 (aarch64) 0.448161
= Note: Bluetooth subsystem version 2.22 0.448169
= New Index: 14:80:CC:D0:0D:09 (Primary,USB,hci0) [hci0] 0.448172
= Open Index: 14:80:CC:D0:0D:09 [hci0] 0.448173
= Index Info: 14:80:CC:D0:0D:09 (not assigned) [hci0] 0.448174
@ MGMT Open: bluetoothd (privileged) version 1.18 {0x0001} 0.448176
@ MGMT Command: Set Bondable (0x0009) plen 1 {0x0001} [hci0] 4.946961
Bondable: Enabled (0x01)
@ MGMT Event: Command Complete (0x0001) plen 7 {0x0001} [hci0] 4.946988
Set Bondable (0x0009) plen 4
Status: Success (0x00)
Current settings: 0x00000ad1
Powered
Bondable
Secure Simple Pairing
BR/EDR
Low Energy
Secure Connections
@ MGMT Command: Set IO Capability (0x0018) plen 1 {0x0001} [hci0] 4.947092
Capability: KeyboardDisplay (0x04)
@ MGMT Event: Command Complete (0x0001) plen 3 {0x0001} [hci0] 4.947098
Set IO Capability (0x0018) plen 0
Status: Success (0x00)
@ MGMT Command: Start Service Discovery (0x003a) plen 4 {0x0001} [hci0] 4.950491
Address type: 0x06
LE Public
LE Random
RSSI: -100 dBm (0x9c)
UUIDs: 0
< HCI Command: LE Set Random Address (0x08|0x0005) plen 6 #1 [hci0] 4.950635
Address: 28:71:4D:EA:81:F4 (Non-Resolvable)

HCI Event: Command Complete (0x0e) plen 4 #2 [hci0] 4.950854
LE Set Random Address (0x08|0x0005) ncmd 5
Status: Success (0x00)
< HCI Command: LE Set Extended Scan Parameters (0x08|0x0041) plen 8 #3 [hci0] 4.951004
Own address type: Random (0x01)
Filter policy: Accept all advertisement (0x00)
PHYs: 0x01
Entry 0: LE 1M
Type: Active (0x01)
Interval: 11.250 msec (0x0012)
Window: 11.250 msec (0x0012)
HCI Event: Command Complete (0x0e) plen 4 #4 [hci0] 4.951227
LE Set Extended Scan Parameters (0x08|0x0041) ncmd 5
Status: Success (0x00)
< HCI Command: LE Set Extended Scan Enable (0x08|0x0042) plen 6 #5 [hci0] 4.951328
Extended scan: Enabled (0x01)
Filter duplicates: Enabled (0x01)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)
HCI Event: Command Complete (0x0e) plen 4 #6 [hci0] 4.951733
LE Set Extended Scan Enable (0x08|0x0042) ncmd 5
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4 {0x0001} [hci0] 4.951840
Start Service Discovery (0x003a) plen 1
Status: Success (0x00)
Address type: 0x06
LE Public
LE Random
@ MGMT Event: Discovering (0x0013) plen 2 {0x0001} [hci0] 4.951860
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)
HCI Event: LE Meta Event (0x3e) plen 43 #7 [hci0] 4.963156
LE Advertising Report (0x02)
Num reports: 1
Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
Address type: Random (0x01)
Address: 19:92:F4:4A:68:A0 (Non-Resolvable)
Data length: 31
Company: Microsoft (6)
Data: 0109202205a083432fc1e5fafa4bf8dedfea94f54505216d50992a
RSSI: -94 dBm (0xa2)
@ MGMT Event: Device Found (0x0012) plen 45 {0x0001} [hci0] 4.963257
LE Address: 19:92:F4:4A:68:A0 (Non-Resolvable)
RSSI: -94 dBm (0xa2)
Flags: 0x00000004
Not Connectable
Data length: 31
Company: Microsoft (6)
Data: 0109202205a083432fc1e5fafa4bf8dedfea94f54505216d50992a
HCI Event: LE Meta Event (0x3e) plen 43 #8 [hci0] 5.010167
LE Advertising Report (0x02)
Num reports: 1
Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
Address type: Random (0x01)
Address: 11:FE:F4:A2:1E:C6 (Non-Resolvable)
Data length: 31
Company: Microsoft (6)
Data: 01092002ffb17b6ec1ae1afbbaed60295a02dba2e9675d09a699b2
RSSI: -79 dBm (0xb1)
@ MGMT Event: Device Found (0x0012) plen 45 {0x0001} [hci0] 5.010286
LE Address: 11:FE:F4:A2:1E:C6 (Non-Resolvable)
RSSI: -79 dBm (0xb1)
Flags: 0x00000004
Not Connectable
Data length: 31
Company: Microsoft (6)
Data: 01092002ffb17b6ec1ae1afbbaed60295a02dba2e9675d09a699b2
HCI Event: LE Meta Event (0x3e) plen 43 #9 [hci0] 5.024782
LE Advertising Report (0x02)
Num reports: 1
Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
Address type: Random (0x01)
Address: 20:53:74:5B:7D:06 (Non-Resolvable)
Data length: 31
Company: Microsoft (6)
Data: 01092022e79fb69393285ee9609c2536c65ab815953a5725e489b3
RSSI: -90 dBm (0xa6)
@ MGMT Event: Device Found (0x0012) plen 45 {0x0001} [hci0] 5.024878
LE Address: 20:53:74:5B:7D:06 (Non-Resolvable)
RSSI: -90 dBm (0xa6)
Flags: 0x00000004
Not Connectable
Data length: 31
Company: Microsoft (6)
Data: 01092022e79fb69393285ee9609c2536c65ab815953a5725e489b3
HCI Event: LE Meta Event (0x3e) plen 43 #10 [hci0] 5.050655
LE Advertising Report (0x02)
Num reports: 1
Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
Address type: Random (0x01)
Address: 01:80:56:C8:C3:2F (Non-Resolvable)
Data length: 31
Company: Microsoft (6)
Data: 0109202218116b33f4ae7a469fb7b8b17aefe48f325200185e20f0
RSSI: -97 dBm (0x9f)
@ MGMT Event: Device Found (0x0012) plen 45 {0x0001} [hci0] 5.050751
LE Address: 01:80:56:C8:C3:2F (Non-Resolvable)
RSSI: -97 dBm (0x9f)
Flags: 0x00000004
Not Connectable
Data length: 31
Company: Microsoft (6)
Data: 0109202218116b33f4ae7a469fb7b8b17aefe48f325200185e20f0
HCI Event: LE Meta Event (0x3e) plen 43 #11 [hci0] 5.104531
LE Advertising Report (0x02)
Num reports: 1
Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
Address type: Random (0x01)
Address: 01:61:B4:69:E7:E0 (Non-Resolvable)
Data length: 31
Company: Microsoft (6)
Data: 010920224335b6fd1d5e7357898d69ab912b86b138e7f9ce8af86f
RSSI: -91 dBm (0xa5)
@ MGMT Event: Device Found (0x0012) plen 45 {0x0001} [hci0] 5.104634
LE Address: 01:61:B4:69:E7:E0 (Non-Resolvable)
RSSI: -91 dBm (0xa5)
Flags: 0x00000004
Not Connectable
Data length: 31
Company: Microsoft (6)
Data: 010920224335b6fd1d5e7357898d69ab912b86b138e7f9ce8af86f
HCI Event: LE Meta Event (0x3e) plen 26 #12 [hci0] 5.139781
LE Advertising Report (0x02)
Num reports: 1
Event type: Connectable undirected - ADV_IND (0x00)
Address type: Random (0x01)
Address: 7F:77:A3:55:A4:5C (Resolvable)
Data length: 14
Flags: 0x1a
LE General Discoverable Mode
Simultaneous LE and BR/EDR (Controller)
Simultaneous LE and BR/EDR (Host)
TX power: 12 dBm
Company: Apple, Inc. (76)
Type: Unknown (16)
Data: 2300
RSSI: -85 dBm (0xab)
HCI Event: LE Meta Event (0x3e) plen 12 #13 [hci0] 5.140399
LE Advertising Report (0x02)
Num reports: 1
Event type: Scan response - SCAN_RSP (0x04)
Address type: Random (0x01)
Address: 7F:77:A3:55:A4:5C (Resolvable)
Data length: 0
RSSI: -85 dBm (0xab)
@ MGMT Event: Device Found (0x0012) plen 28 {0x0001} [hci0] 5.140479
LE Address: 7F:77:A3:55:A4:5C (Resolvable)
RSSI: -85 dBm (0xab)
Flags: 0x00000000
Data length: 14
Flags: 0x1a
LE General Discoverable Mode
Simultaneous LE and BR/EDR (Controller)
Simultaneous LE and BR/EDR (Host)
TX power: 12 dBm
Company: Apple, Inc. (76)
Type: Unknown (16)
Data: 2300
HCI Event: LE Meta Event (0x3e) plen 55 #14 [hci0] 5.199779
LE Extended Advertising Report (0x0d)
Num reports: 1
Entry 0
Event type: 0x0001
Props: 0x0001
Connectable
Data status: Complete
Address type: Random (0x01)
Address: 76:93:22:A0:16:B6 (Resolvable)
Primary PHY: LE 1M
Secondary PHY: LE 1M
SID: 0x00
TX power: 127 dBm
RSSI: -90 dBm (0xa6)
Periodic advertising interval: 0.00 msec (0x0000)
Direct address type: Public (0x00)
Direct address: 00:00:00:00:00:00 (OUI 00-00-00)
Data length: 0x1d
02 01 02 19 16 c0 fc 03 01 01 80 fa 02 50 46 ab .............PF.
03 03 0f 80 a3 03 00 8a 29 23 77 74 79 ........)#wty
Flags: 0x02
LE General Discoverable Mode
Service Data: Unknown (0xfcc0)
Data: 03010180fa025046ab03030f80a303008a2923777479
@ MGMT Event: Device Found (0x0012) plen 14 {0x0001} [hci0] 5.199874
LE Address: 00:00:00:00:00:00 (Non-Resolvable)
RSSI: -85 dBm (0xab)
Flags: 0x00000000
Data length: 0
@ MGMT Event: Device Found (0x0012) plen 43 {0x0001} [hci0] 5.199890
LE Address: 76:93:22:A0:16:B6 (Resolvable)
RSSI: -90 dBm (0xa6)
Flags: 0x00000000
Data length: 29
Flags: 0x02
LE General Discoverable Mode
Service Data: Unknown (0xfcc0)
Data: 03010180fa025046ab03030f80a303008a2923777479
@ MGMT Command: Set Bondable (0x0009) plen 1 {0x0001} [hci0] 5.213566
Bondable: Disabled (0x00)
@ MGMT Event: Command Complete (0x0001) plen 7 {0x0001} [hci0] 5.213596
Set Bondable (0x0009) plen 4
Status: Success (0x00)
Current settings: 0x00000ac1
Powered
Secure Simple Pairing
BR/EDR
Low Energy
Secure Connections
@ MGMT Command: Stop Discovery (0x0024) plen 1 {0x0001} [hci0] 5.213854
Address type: 0x06
LE Public
LE Random
< HCI Command: LE Set Extended Scan Enable (0x08|0x0042) plen 6 #15 [hci0] 5.213965
Extended scan: Disabled (0x00)
Filter duplicates: Disabled (0x00)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)
HCI Event: Command Complete (0x0e) plen 4 #16 [hci0] 5.214233
LE Set Extended Scan Enable (0x08|0x0042) ncmd 5
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4 {0x0001} [hci0] 5.214456
Stop Discovery (0x0024) plen 1
Status: Success (0x00)
Address type: 0x06
LE Public
LE Random
@ MGMT Event: Discovering (0x0013) plen 2 {0x0001} [hci0] 5.214479
Address type: 0x06
LE Public
LE Random
Discovery: Disabled (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #17 [hci0] 5.214537
Address type: Random (0x01)
Address: 00:00:00:00:00:00 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #18 [hci0] 5.214728
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #19 [hci0] 5.214812
Address type: Random (0x01)
Address: 7F:77:A3:55:A4:5C (Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #20 [hci0] 5.214976
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #21 [hci0] 5.215031
Address type: Random (0x01)
Address: 01:61:B4:69:E7:E0 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #22 [hci0] 5.215227
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #23 [hci0] 5.215309
Address type: Random (0x01)
Address: 01:80:56:C8:C3:2F (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #24 [hci0] 5.215626
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #25 [hci0] 5.281585
Address type: Random (0x01)
Address: 20:53:74:5B:7D:06 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #26 [hci0] 5.281871
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #27 [hci0] 5.561600
Address type: Random (0x01)
Address: 11:FE:F4:A2:1E:C6 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #28 [hci0] 5.561871
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #29 [hci0] 5.561930
Address type: Random (0x01)
Address: 19:92:F4:4A:68:A0 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #30 [hci0] 5.562105
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Success (0x00)
< HCI Command: LE Set Extended Scan Parameters (0x08|0x0041) plen 8 #31 [hci0] 5.562189
Own address type: Public (0x00)
Filter policy: Ignore not in accept list (0x01)
PHYs: 0x01
Entry 0: LE 1M
Type: Passive (0x00)
Interval: 60.000 msec (0x0060)
Window: 60.000 msec (0x0060)
HCI Event: Command Complete (0x0e) plen 4 #32 [hci0] 5.562368
LE Set Extended Scan Parameters (0x08|0x0041) ncmd 5
Status: Success (0x00)
< HCI Command: LE Set Extended Scan Enable (0x08|0x0042) plen 6 #33 [hci0] 5.562446
Extended scan: Enabled (0x01)
Filter duplicates: Enabled (0x01)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)
HCI Event: Command Complete (0x0e) plen 4 #34 [hci0] 5.562602
LE Set Extended Scan Enable (0x08|0x0042) ncmd 5
Status: Success (0x00)
< HCI Command: LE Set Extended Scan Enable (0x08|0x0042) plen 6 #35 [hci0] 5.562728
Extended scan: Disabled (0x00)
Filter duplicates: Disabled (0x00)
Duration: 0 msec (0x0000)
Period: 0.00 sec (0x0000)
HCI Event: Command Complete (0x0e) plen 4 #36 [hci0] 5.564728
LE Set Extended Scan Enable (0x08|0x0042) ncmd 5
Status: Success (0x00)
< HCI Command: LE Remove Device From Accept List (0x08|0x0012) plen 7 #37 [hci0] 5.564854
Address type: Random (0x01)
Address: 19:92:F4:4A:68:A0 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #38 [hci0] 5.565139
LE Remove Device From Accept List (0x08|0x0012) ncmd 5
Status: Success (0x00)
< HCI Command: LE Remove Device From Accept List (0x08|0x0012) plen 7 #39 [hci0] 5.565187
Address type: Random (0x01)
Address: 11:FE:F4:A2:1E:C6 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #40 [hci0] 5.565388
LE Remove Device From Accept List (0x08|0x0012) ncmd 5
Status: Success (0x00)
< HCI Command: LE Remove Device From Accept List (0x08|0x0012) plen 7 #41 [hci0] 5.565437
Address type: Random (0x01)
Address: 20:53:74:5B:7D:06 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #42 [hci0] 5.565637
LE Remove Device From Accept List (0x08|0x0012) ncmd 5
Status: Success (0x00)
< HCI Command: LE Remove Device From Accept List (0x08|0x0012) plen 7 #43 [hci0] 5.565683
Address type: Random (0x01)
Address: 01:80:56:C8:C3:2F (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #44 [hci0] 5.565848
LE Remove Device From Accept List (0x08|0x0012) ncmd 5
Status: Success (0x00)
< HCI Command: LE Remove Device From Accept List (0x08|0x0012) plen 7 #45 [hci0] 5.565883
Address type: Random (0x01)
Address: 01:61:B4:69:E7:E0 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #46 [hci0] 5.566100
LE Remove Device From Accept List (0x08|0x0012) ncmd 5
Status: Success (0x00)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #47 [hci0] 5.566138
Address type: Random (0x01)
Address: 00:00:00:00:00:00 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #48 [hci0] 5.566348
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Invalid HCI Command Parameters (0x12)
@ MGMT Event: Connect Failed (0x000d) plen 8 {0x0001} [hci0] 5.566399
LE Address: 00:00:00:00:00:00 (Non-Resolvable)
Status: Invalid Parameters (0x0d)
HCI Event: Command Complete (0x0e) plen 4 #57 [hci0] 5.029397
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Invalid HCI Command Parameters (0x12)
@ MGMT Event: Connect Failed (0x000d) plen 8 {0x0001} [hci0] 5.029495
LE Address: 80:3E:4F:85:30:9A (OUI 80-3E-4F)
Status: Invalid Parameters (0x0d)
ACL Data RX: Handle 17 flags 0x02 dlen 7 #58 [hci0] 5.079081
ATT: Exchange MTU Response (0x03) len 2
Server RX MTU: 517
ACL Data RX: Handle 17 flags 0x02 dlen 11 #59 [hci0] 5.079539
ATT: Read By Group Type Request (0x10) len 6
Handle range: 0x0001-0xffff
Attribute group type: Primary Service (0x2800)
< HCI Command: LE Add Device To Accept List (0x08|0x0011) plen 7 #60 [hci0] 5.084951
Address type: Random (0x01)
Address: 00:00:00:00:00:00 (Non-Resolvable)
HCI Event: Command Complete (0x0e) plen 4 #61 [hci0] 5.085151
LE Add Device To Accept List (0x08|0x0011) ncmd 5
Status: Invalid HCI Command Parameters (0x12)

[weliem]

Well, I see that in your code you are connecting to every device that is found during discovery!!! That is not a good idea....

It looks like you have a strange device with address 00:00:00:00:00:00 in range. It seems to send corrupt advertising data. Even BTMon cannot make sense out it...

Nonetheless, I did a quick fix to at least not crash on it....maybe it works, please try
8d38fd9

[w544503507]

**Thank you very much for your help, but I still encounter a crash in these functions:#0 0x0000007ff7694c1c in g_variant_iter_loop () from /usr/lib/libglib-2.0.so.0#1 0x0000007ff75e695c in binc_internal_device_update_property () from /usr/lib/bluetooth/libbinc.so.0
I tried comparing the binc code from 2023 that didn't crash. I found the difference in this function between the two versions of the code:
The new version has:GByteArray byteArray = g_byte_array_sized_new((guint) data_length);g_byte_array_append(byteArray, data, (guint) data_length);
While the old version has:GByteArray byteArray = g_byte_array_sized_new(data_length);g_byte_array_append(byteArray, data, data_length);
In the old version, it uses the size_t type without the (guint) cast. After I modified this part to the old version's code, the crash issue was resolved. However, I still don't understand why this fixed the problem.

void binc_internal_device_update_property(Device *device, const char *property_name, GVariant *property_value) {
if (g_str_equal(property_name, DEVICE_PROPERTY_ADDRESS)) {
binc_device_set_address(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_ADDRESS_TYPE)) {
binc_device_set_address_type(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_ALIAS)) {
binc_device_set_alias(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_CONNECTED)) {
binc_device_internal_set_conn_state(device, g_variant_get_boolean(property_value) ? BINC_CONNECTED : BINC_DISCONNECTED,
NULL);
} else if (g_str_equal(property_name, DEVICE_PROPERTY_NAME)) {
binc_device_set_name(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_PAIRED)) {
binc_device_set_paired(device, g_variant_get_boolean(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_RSSI)) {
binc_device_set_rssi(device, g_variant_get_int16(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_TRUSTED)) {
binc_device_set_trusted(device, g_variant_get_boolean(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_TXPOWER)) {
binc_device_set_txpower(device, g_variant_get_int16(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_UUIDS)) {
binc_device_set_uuids(device, g_variant_string_array_to_list(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_MANUFACTURER_DATA)) {
// Setup iterator
GVariantIter *iter;
g_variant_get(property_value, "a{qv}", &iter);
// if (iter == NULL)
// return;

    GVariant *array;
    guint16 key;
    GHashTable *manufacturer_data = g_hash_table_new_full(g_int_hash, g_int_equal,
                                                          g_free, (GDestroyNotify) byte_array_free);
    while (g_variant_iter_loop(iter, "{qv}", &key, &array)) {
        size_t data_length = 0;
        guint8 *data = (guint8 *) g_variant_get_fixed_array(array, &data_length, sizeof(guint8));
        GByteArray *byteArray = g_byte_array_sized_new(data_length);
        g_byte_array_append(byteArray, data, data_length);

        int *keyCopy = g_new0 (gint, 1);
        *keyCopy = key;

        g_hash_table_insert(manufacturer_data, keyCopy, byteArray);
    }
    binc_device_set_manufacturer_data(device, manufacturer_data);
    g_variant_iter_free(iter);
} else if (g_str_equal(property_name, DEVICE_PROPERTY_SERVICE_DATA)) {
    GVariantIter *iter;
    g_variant_get(property_value, "a{sv}", &iter);
    // if (iter == NULL)
    //     return;

    GVariant *array;
    char *key;

    GHashTable *service_data = g_hash_table_new_full(g_str_hash, g_str_equal,
                                                     g_free, (GDestroyNotify) byte_array_free);
    while (g_variant_iter_loop(iter, "{sv}", &key, &array)) {
        size_t data_length = 0;
        guint8 *data = (guint8 *) g_variant_get_fixed_array(array, &data_length, sizeof(guint8));
        GByteArray *byteArray = g_byte_array_sized_new(data_length);
        g_byte_array_append(byteArray, data, data_length);

        char *keyCopy = g_strdup(key);

        g_hash_table_insert(service_data, keyCopy, byteArray);
    }
    binc_device_set_service_data(device, service_data);
    g_variant_iter_free(iter);
}

}

[weliem]

size_t and gsize are both 'unsigned long' but g_variant_get_fixed_array() expects gsize. So that's why that was updated. But g_byte_array_sized_new expects an 'unsigned int' so we can't use size_t/gsize. Effectively the bytearray gets truncated by the cast. But since we are talking about BLE advertisement data where bytearrays are tiny, this can NEVER be a problem. They are always smaller than the G_MAXUINT value.

I still think the device you are finding in the scan is sending an illegal advertisement package that confuses Bluez. Try to put a breakpoint on the line with 'GByteArray *byteArray = g_byte_array_sized_new(data_length);' and see what the value of data_length is. It must be some enormous number...

[w544503507]

Thank you for your help. I added the print information as you suggested and conducted multiple tests.
This is the first time:Manufacturer data

• Key: 6, data_length: 27Manufacturer data - Key: 76, data_length: 7Manufacturer data - Key: 34952, data_length: 23Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 911, data_length: 20Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 76, data_length: 8Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 510, data_length: 18Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 76, data_length: 4Manufacturer data - Key: 34952, data_length: 23Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 76, data_length: 9Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 2103, data_length: 18Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 510, data_length: 18Service data - Key: 00000010-0000-1000-8000-00805f9b34fb, data_length: 2Segmentation fault (core dumped)

This is the second time:Manufacturer data

• Key: 6, data_length: 27Manufacturer data - Key: 34952, data_length: 23Manufacturer data - Key: 76, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 6, data_length: 27Manufacturer data - Key: 76, data_length: 4Service data - Key: 0000fdee-0000-1000-8000-00805f9b34fb, data_length: 17Segmentation fault (core dumped)

I found that whenever it comes to Service data and the data_length is of the gsize data type, it crashes no matter what the length is.

void binc_internal_device_update_property(Device *device, const char *property_name, GVariant *property_value) {
if (g_str_equal(property_name, DEVICE_PROPERTY_ADDRESS)) {
binc_device_set_address(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_ADDRESS_TYPE)) {
binc_device_set_address_type(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_ALIAS)) {
binc_device_set_alias(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_CONNECTED)) {
binc_device_internal_set_conn_state(device, g_variant_get_boolean(property_value) ? BINC_CONNECTED : BINC_DISCONNECTED,
NULL);
} else if (g_str_equal(property_name, DEVICE_PROPERTY_NAME)) {
binc_device_set_name(device, g_variant_get_string(property_value, NULL));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_PAIRED)) {
binc_device_set_paired(device, g_variant_get_boolean(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_RSSI)) {
binc_device_set_rssi(device, g_variant_get_int16(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_TRUSTED)) {
binc_device_set_trusted(device, g_variant_get_boolean(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_TXPOWER)) {
binc_device_set_txpower(device, g_variant_get_int16(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_UUIDS)) {
binc_device_set_uuids(device, g_variant_string_array_to_list(property_value));
} else if (g_str_equal(property_name, DEVICE_PROPERTY_MANUFACTURER_DATA)) {
// Setup iterator
GVariantIter *iter;
g_variant_get(property_value, "a{qv}", &iter);
if (iter == NULL)
return;

    GVariant *array;
    guint16 key;
    GHashTable *manufacturer_data = g_hash_table_new_full(g_int_hash, g_int_equal,
                                                          g_free, (GDestroyNotify) byte_array_free);
    while (g_variant_iter_loop(iter, "{qv}", &key, &array)) {
        gsize data_length = 0;
        guint8 *data = (guint8 *) g_variant_get_fixed_array(array, &data_length, sizeof(guint8));
        g_print("Manufacturer data - Key: %u, data_length: %zu\n", key, data_length);
        GByteArray *byteArray = g_byte_array_sized_new((guint) data_length);
        g_byte_array_append(byteArray, data, (guint) data_length);

        int *keyCopy = g_new0 (gint, 1);
        *keyCopy = key;

        g_hash_table_insert(manufacturer_data, keyCopy, byteArray);
    }
    binc_device_set_manufacturer_data(device, manufacturer_data);
    g_variant_iter_free(iter);
} else if (g_str_equal(property_name, DEVICE_PROPERTY_SERVICE_DATA)) {
    GVariantIter *iter;
    g_variant_get(property_value, "a{sv}", &iter);
     if (iter == NULL)
         return;

    GVariant *array;
    char *key;

    GHashTable *service_data = g_hash_table_new_full(g_str_hash, g_str_equal,
                                                     g_free, (GDestroyNotify) byte_array_free);
    while (g_variant_iter_loop(iter, "{sv}", &key, &array)) {
        gsize data_length = 0;
        guint8 *data = (guint8 *) g_variant_get_fixed_array(array, &data_length, sizeof(guint8));
        g_print("Service data - Key: %s, data_length: %zu\n", key, data_length);
        GByteArray *byteArray = g_byte_array_sized_new((guint) data_length);
        g_byte_array_append(byteArray, data, (guint) data_length);

        char *keyCopy = g_strdup(key);

        g_hash_table_insert(service_data, keyCopy, byteArray);
    }
    binc_device_set_service_data(device, service_data);
    g_variant_iter_free(iter);
}

}