mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-11-04 13:30:12 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

pulse-server: limit writes to ringbuffer

Browse source 
We can't write more to the ringbuffer than its maxsize. Some clients
send more than the negotiated maxsize and cause a crash if we don't
clamp.

See #440
This commit is contained in:
Wim Taymans 2020-12-17 19:39:12 +01:00
parent e0580fedc1
commit 1a690a0cbb
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/modules/module-protocol-pulse/pulse-server.c
View file

@ -1488,11 +1488,12 @@ static void stream_process(void *data)
stream, client->name, pd.write_index, filled, stream, client->name, pd.write_index, filled,
size, stream->attr.maxlength); size, stream->attr.maxlength);
} }
spa_ringbuffer_write_data(&stream->ring, spa_ringbuffer_write_data(&stream->ring,
stream->buffer, stream->attr.maxlength, stream->buffer, stream->attr.maxlength,
pd.write_index % stream->attr.maxlength, pd.write_index % stream->attr.maxlength,
SPA_MEMBER(p, buf->datas[0].chunk->offset, void), SPA_MEMBER(p, buf->datas[0].chunk->offset, void),
size); SPA_MIN(size, stream->attr.maxlength));
pd.write_index += size; pd.write_index += size;
spa_ringbuffer_write_update(&stream->ring, pd.write_index); spa_ringbuffer_write_update(&stream->ring, pd.write_index);
@ -4792,12 +4793,14 @@ static int handle_memblock(struct client *client, struct message *msg)
/* overrun */ /* overrun */
send_overflow(stream); send_overflow(stream);
} }
/* always write data to ringbuffer, we expect the other side /* always write data to ringbuffer, we expect the other side
* to recover */ * to recover */
spa_ringbuffer_write_data(&stream->ring, spa_ringbuffer_write_data(&stream->ring,
stream->buffer, stream->attr.maxlength, stream->buffer, stream->attr.maxlength,
index % stream->attr.maxlength, index % stream->attr.maxlength,
msg->data, msg->length); msg->data,
SPA_MIN(msg->length, stream->attr.maxlength));
stream->write_index = index + msg->length; stream->write_index = index + msg->length;
spa_ringbuffer_write_update(&stream->ring, stream->write_index); spa_ringbuffer_write_update(&stream->ring, stream->write_index);
stream->requested -= msg->length; stream->requested -= msg->length;