mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-11-03 09:01:54 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

media-session: make sure we don't read invalid data

Browse source
This commit is contained in:
Wim Taymans 2020-10-01 11:32:40 +02:00
parent 62b882c13d
commit 0da406d304
2 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/examples/media-session/default-routes.c
View file

@ -176,10 +176,13 @@ static int restore_route(struct device *dev, const char *val, uint32_t index, ui
spa_pod_builder_prop(&b, SPA_PARAM_ROUTE_props, 0); spa_pod_builder_prop(&b, SPA_PARAM_ROUTE_props, 0);
spa_pod_builder_push_object(&b, &f[1], spa_pod_builder_push_object(&b, &f[1],
SPA_TYPE_OBJECT_Props, SPA_PARAM_Route); SPA_TYPE_OBJECT_Props, SPA_PARAM_Route);
for (p = val; *p; p++) {
p = val;
while (*p) {
if (strstr(p, "volume:") == p) { if (strstr(p, "volume:") == p) {
vol = strtof(p+7, &end); p += 7;
if (end == p + 7) vol = strtof(p, &end);
if (end == p)
continue; continue;
spa_pod_builder_prop(&b, SPA_PROP_volume, 0); spa_pod_builder_prop(&b, SPA_PROP_volume, 0);
spa_pod_builder_float(&b, vol); spa_pod_builder_float(&b, vol);
@ -192,14 +195,18 @@ static int restore_route(struct device *dev, const char *val, uint32_t index, ui
p+=6; p+=6;
} }
else if (strstr(p, "volumes:") == p) { else if (strstr(p, "volumes:") == p) {
n_vols = strtol(p+8, &end, 10); p += 8;
if (end == p+8 || n_vols >= SPA_AUDIO_MAX_CHANNELS) n_vols = strtol(p, &end, 10);
if (end == p)
continue; continue;
p = end; p = end;
if (n_vols >= SPA_AUDIO_MAX_CHANNELS)
continue;
vols = alloca(n_vols * sizeof(float)); vols = alloca(n_vols * sizeof(float));
for (i = 0; i < n_vols && *p == ','; i++) { for (i = 0; i < n_vols && *p == ','; i++) {
vols[i] = strtof(p+1, &end); p++;
if (end == p+1) vols[i] = strtof(p, &end);
if (end == p)
break; break;
p = end; p = end;
} }
@ -209,6 +216,8 @@ static int restore_route(struct device *dev, const char *val, uint32_t index, ui
spa_pod_builder_prop(&b, SPA_PROP_channelVolumes, 0); spa_pod_builder_prop(&b, SPA_PROP_channelVolumes, 0);
spa_pod_builder_array(&b, sizeof(float), SPA_TYPE_Float, spa_pod_builder_array(&b, sizeof(float), SPA_TYPE_Float,
n_vols, vols); n_vols, vols);
} else {
p++;
} }
} }
spa_pod_builder_pop(&b, &f[1]); spa_pod_builder_pop(&b, &f[1]);

26
src/examples/media-session/restore-stream.c
View file

@ -202,9 +202,13 @@ static int restore_stream(struct stream *str, const char *val)
spa_pod_builder_push_object(&b, &f[0], spa_pod_builder_push_object(&b, &f[0],
SPA_TYPE_OBJECT_Props, SPA_PARAM_Props); SPA_TYPE_OBJECT_Props, SPA_PARAM_Props);
for (p = val; *p; p++) { p = val;
while (*p) {
if (strstr(p, "volume:") == p) { if (strstr(p, "volume:") == p) {
vol = strtof(p+7, &end); p += 7;
vol = strtof(p, &end);
if (end == p)
continue;
spa_pod_builder_prop(&b, SPA_PROP_volume, 0); spa_pod_builder_prop(&b, SPA_PROP_volume, 0);
spa_pod_builder_float(&b, vol); spa_pod_builder_float(&b, vol);
p = end; p = end;
@ -216,15 +220,23 @@ static int restore_stream(struct stream *str, const char *val)
p+=6; p+=6;
} }
else if (strstr(p, "volumes:") == p) { else if (strstr(p, "volumes:") == p) {
n_vols = strtol(p+8, &end, 10); p += 8;
if (n_vols >= SPA_AUDIO_MAX_CHANNELS) n_vols = strtol(p, &end, 10);
if (end == p)
continue; continue;
p = end; p = end;
if (n_vols >= SPA_AUDIO_MAX_CHANNELS)
continue;
vols = alloca(n_vols * sizeof(float)); vols = alloca(n_vols * sizeof(float));
for (i = 0; i < n_vols; i++) { for (i = 0; i < n_vols && *p == ','; i++) {
vols[i] = strtof(p+1, &end); p++;
vols[i] = strtof(p, &end);
if (end == p)
break;
p = end; p = end;
} }
if (i != n_vols)
continue;
spa_pod_builder_prop(&b, SPA_PROP_channelVolumes, 0); spa_pod_builder_prop(&b, SPA_PROP_channelVolumes, 0);
spa_pod_builder_array(&b, sizeof(float), SPA_TYPE_Float, spa_pod_builder_array(&b, sizeof(float), SPA_TYPE_Float,
n_vols, vols); n_vols, vols);
@ -238,6 +250,8 @@ static int restore_stream(struct stream *str, const char *val)
i = end - p; i = end - p;
strncpy(target, p, i); strncpy(target, p, i);
target[i-1] = 0; target[i-1] = 0;
} else {
p++;
} }
} }
param = spa_pod_builder_pop(&b, &f[0]); param = spa_pod_builder_pop(&b, &f[0]);