mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-11-05 13:30:02 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

pulse-server: limit writes to ringbuffer

Browse source 
We can't write more to the ringbuffer than its maxsize. Some clients
send more than the negotiated maxsize and cause a crash if we don't
clamp.

See #440
This commit is contained in:
Wim Taymans 2020-12-17 19:39:12 +01:00
parent e0580fedc1
commit 1a690a0cbb
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/modules/module-protocol-pulse/pulse-server.c
View file

@ -1488,11 +1488,12 @@ static void stream_process(void *data)
stream, client->name, pd.write_index, filled,
size, stream->attr.maxlength);
}
spa_ringbuffer_write_data(&stream->ring,
stream->buffer, stream->attr.maxlength,
pd.write_index % stream->attr.maxlength,
SPA_MEMBER(p, buf->datas[0].chunk->offset, void),
size);
SPA_MIN(size, stream->attr.maxlength));
pd.write_index += size;
spa_ringbuffer_write_update(&stream->ring, pd.write_index);
@ -4792,12 +4793,14 @@ static int handle_memblock(struct client *client, struct message *msg)
/* overrun */
send_overflow(stream);
}
/* always write data to ringbuffer, we expect the other side
* to recover */
spa_ringbuffer_write_data(&stream->ring,
stream->buffer, stream->attr.maxlength,
index % stream->attr.maxlength,
msg->data, msg->length);
msg->data,
SPA_MIN(msg->length, stream->attr.maxlength));
stream->write_index = index + msg->length;
spa_ringbuffer_write_update(&stream->ring, stream->write_index);
stream->requested -= msg->length;