mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-27 06:46:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

module-avb: fix GET_NAME to validate length before field reads and reply with fixed size

Browse source
This commit is contained in:
hackerman-kl 2026-04-24 07:52:17 +02:00
parent 01dd7e607c
commit 0ac8b1c5fa
1 changed files with 9 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/modules/module-avb/aecp-aem-cmds-resps/cmd-get-set-name.c
View file

@ -102,6 +102,12 @@ int handle_cmd_get_name_common(struct aecp *aecp, int64_t now,
struct descriptor *desc; struct descriptor *desc;
uint16_t desc_type, desc_id, name_index; uint16_t desc_type, desc_id, name_index;
char *name_ptr; char *name_ptr;
size_t reply_len;
if (len < 0 || (size_t)len > sizeof(buf) ||
(size_t)len < sizeof(*h) + sizeof(*p) + sizeof(*cmd))
return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
cmd = (const struct avb_packet_aecp_aem_setget_name *)p->payload; cmd = (const struct avb_packet_aecp_aem_setget_name *)p->payload;
desc_type = ntohs(cmd->descriptor_type); desc_type = ntohs(cmd->descriptor_type);
@ -118,12 +124,9 @@ int handle_cmd_get_name_common(struct aecp *aecp, int64_t now,
return reply_status(aecp, return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len); AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
if (len < 0 || (size_t)len > sizeof(buf) || reply_len = sizeof(*h) + sizeof(*p) + sizeof(*cmd);
(size_t)len < sizeof(*h) + sizeof(*p) + sizeof(*cmd))
return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
memcpy(buf, m, len); memcpy(buf, m, reply_len);
h_reply = (struct avb_ethernet_header *)buf; h_reply = (struct avb_ethernet_header *)buf;
p_reply = SPA_PTROFF(h_reply, sizeof(*h_reply), void); p_reply = SPA_PTROFF(h_reply, sizeof(*h_reply), void);
reply = (struct avb_packet_aecp_aem_setget_name *)p_reply->payload; reply = (struct avb_packet_aecp_aem_setget_name *)p_reply->payload;
@ -135,7 +138,7 @@ int handle_cmd_get_name_common(struct aecp *aecp, int64_t now,
*/ */
memcpy(reply->name, name_ptr, 64); memcpy(reply->name, name_ptr, 64);
return reply_success(aecp, buf, len); return reply_success(aecp, buf, reply_len);
} }