mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-27 06:46:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

module-avb: bound packet copy length in reply_status helper

Browse source
This commit is contained in:
hackerman-kl 2026-04-24 07:02:54 +02:00
parent f091b85b03
commit 01dd7e607c
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/modules/module-avb/aecp-aem-cmds-resps/cmd-resp-helpers.h
View file

@ -6,6 +6,7 @@
#ifndef __AVB_AECP_AEM_HELPERS_H__ #ifndef __AVB_AECP_AEM_HELPERS_H__
#define __AVB_AECP_AEM_HELPERS_H__ #define __AVB_AECP_AEM_HELPERS_H__
#include <errno.h>
#include <stdint.h> #include <stdint.h>
#include <string.h> #include <string.h>
@ -21,6 +22,11 @@ static inline int reply_status(struct aecp *aecp, int status, const void *m, int
struct avb_ethernet_header *h = (void*)buf; struct avb_ethernet_header *h = (void*)buf;
struct avb_packet_aecp_header *reply = SPA_PTROFF(h, sizeof(*h), void); struct avb_packet_aecp_header *reply = SPA_PTROFF(h, sizeof(*h), void);
if (len < 0 || (size_t)len > sizeof(buf)) {
pw_log_warn("reply_status: invalid len %d", len);
return -EINVAL;
}
memcpy(buf, m, len); memcpy(buf, m, len);
pw_log_debug("status 0x%x\n", status); pw_log_debug("status 0x%x\n", status);