From 12bddf652147a2903c0bb18668486567028e1730 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= Date: Tue, 19 Mar 2024 16:57:02 +0100 Subject: [PATCH] pulse-server: stricter length checking when deserializing property list The length of the value for each value in a property list is serialized twice. Both the reference implementation and pipewire-pulse send the same length, so be stricter and only accept a property list if both lengths are the same. --- src/modules/module-protocol-pulse/message.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/modules/module-protocol-pulse/message.c b/src/modules/module-protocol-pulse/message.c index 9423a676e..6adf00bad 100644 --- a/src/modules/module-protocol-pulse/message.c +++ b/src/modules/module-protocol-pulse/message.c @@ -122,6 +122,9 @@ static int read_props(struct message *m, struct pw_properties *props, bool remap TAG_INVALID)) < 0) return res; + if (length != size) + return -EINVAL; + if (remap && (map = str_map_find(props_key_map, NULL, key)) != NULL) { key = map->pw_str; if (map->child != NULL &&