mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-27 06:46:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

milan-avb: validate packet length before dereferencing SET_CONTROL value byte

Browse source
This commit is contained in:
hackerman-kl 2026-04-19 07:39:03 +02:00
parent 0291895498
commit 09f9100ce7
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/modules/module-avb/aecp-aem-cmds-resps/cmd-get-set-control.c
View file

@ -150,6 +150,11 @@ static int handle_cmd_set_control_identify(struct aecp *aecp, struct descriptor
old_value_format = desc_formats; old_value_format = desc_formats;
value_req = (uint8_t *)control->payload; value_req = (uint8_t *)control->payload;
if (len < 0 || (size_t)len < sizeof(*h) + sizeof(*p) +
sizeof(*control) + CONTROL_LINEAR_UINT8_SIZE)
return reply_status(aecp, AVB_AECP_AEM_STATUS_BAD_ARGUMENTS,
m, len);
if (*value_req == desc_formats->current_value) { if (*value_req == desc_formats->current_value) {
return reply_success(aecp, m, len); return reply_success(aecp, m, len);
} }