mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-05-29 21:37:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

filter-graph: guard against overflow of graph input/output

Browse source
This commit is contained in:
Wim Taymans 2026-05-04 13:42:14 +02:00
parent 2c1a990a4d
commit 2bfdc36954
1 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

31
spa/plugins/filter-graph/filter-graph.c
View file

@ -1806,6 +1806,7 @@ static int setup_graph(struct graph *graph)
struct graph_port *gp; struct graph_port *gp;
struct graph_hndl *gh; struct graph_hndl *gh;
uint32_t i, j, n, n_input, n_output, n_hndl = 0, n_out_hndl; uint32_t i, j, n, n_input, n_output, n_hndl = 0, n_out_hndl;
size_t input_count, output_count;
int res; int res;
struct descriptor *desc; struct descriptor *desc;
const struct spa_fga_descriptor *d; const struct spa_fga_descriptor *d;
@ -1879,9 +1880,11 @@ static int setup_graph(struct graph *graph)
spa_log_info(impl->log, "using %d instances %d %d", n_hndl, n_input, n_output); spa_log_info(impl->log, "using %d instances %d %d", n_hndl, n_input, n_output);
graph->n_input = 0; graph->n_input = 0;
graph->input = calloc(n_input * 16 * n_hndl, sizeof(struct graph_port)); input_count = n_input * 16 * n_hndl;
graph->input = calloc(input_count, sizeof(struct graph_port));
graph->n_output = 0; graph->n_output = 0;
graph->output = calloc(n_output * n_hndl, sizeof(struct graph_port)); output_count = n_output * n_hndl;
graph->output = calloc(output_count, sizeof(struct graph_port));
/* now collect all input and output ports for all the handles. */ /* now collect all input and output ports for all the handles. */
for (i = 0; i < n_hndl; i++) { for (i = 0; i < n_hndl; i++) {
@ -1889,6 +1892,10 @@ static int setup_graph(struct graph *graph)
desc = first->desc; desc = first->desc;
d = desc->desc; d = desc->desc;
for (j = 0; j < desc->n_input; j++) { for (j = 0; j < desc->n_input; j++) {
if (graph->n_input >= input_count) {
res = -ENOSPC;
goto error;
}
gp = &graph->input[graph->n_input++]; gp = &graph->input[graph->n_input++];
spa_log_info(impl->log, "input port %s[%d]:%s", spa_log_info(impl->log, "input port %s[%d]:%s",
first->name, i, d->ports[desc->input[j]].name); first->name, i, d->ports[desc->input[j]].name);
@ -1901,6 +1908,10 @@ static int setup_graph(struct graph *graph)
for (n = 0; n < graph->n_input_names; n++) { for (n = 0; n < graph->n_input_names; n++) {
pname = graph->input_names[n]; pname = graph->input_names[n];
if (spa_streq(pname, "null")) { if (spa_streq(pname, "null")) {
if (graph->n_input >= input_count) {
res = -ENOSPC;
goto error;
}
gp = &graph->input[graph->n_input++]; gp = &graph->input[graph->n_input++];
gp->desc = NULL; gp->desc = NULL;
spa_log_info(impl->log, "ignore input port %d", graph->n_input); spa_log_info(impl->log, "ignore input port %d", graph->n_input);
@ -1936,6 +1947,10 @@ static int setup_graph(struct graph *graph)
spa_list_for_each(link, &p->link_list, output_link) { spa_list_for_each(link, &p->link_list, output_link) {
struct port *peer = link->input; struct port *peer = link->input;
if (graph->n_input >= input_count) {
res = -ENOSPC;
goto error;
}
spa_log_info(impl->log, "copy input port %s[%d]:%s", spa_log_info(impl->log, "copy input port %s[%d]:%s",
port->node->name, i, port->node->name, i,
d->ports[port->p].name); d->ports[port->p].name);
@ -1954,6 +1969,10 @@ static int setup_graph(struct graph *graph)
port->node->disabled = disabled; port->node->disabled = disabled;
} }
if (!disabled) { if (!disabled) {
if (graph->n_input >= input_count) {
res = -ENOSPC;
goto error;
}
spa_log_info(impl->log, "input port %s[%d]:%s", spa_log_info(impl->log, "input port %s[%d]:%s",
port->node->name, i, d->ports[port->p].name); port->node->name, i, d->ports[port->p].name);
port->external = graph->n_input; port->external = graph->n_input;
@ -1971,6 +1990,10 @@ static int setup_graph(struct graph *graph)
desc = last->desc; desc = last->desc;
d = desc->desc; d = desc->desc;
for (j = 0; j < desc->n_output; j++) { for (j = 0; j < desc->n_output; j++) {
if (graph->n_output >= output_count) {
res = -ENOSPC;
goto error;
}
gp = &graph->output[graph->n_output++]; gp = &graph->output[graph->n_output++];
spa_log_info(impl->log, "output port %s[%d]:%s", spa_log_info(impl->log, "output port %s[%d]:%s",
last->name, i, d->ports[desc->output[j]].name); last->name, i, d->ports[desc->output[j]].name);
@ -1982,6 +2005,10 @@ static int setup_graph(struct graph *graph)
} else { } else {
for (n = 0; n < graph->n_output_names; n++) { for (n = 0; n < graph->n_output_names; n++) {
pname = graph->output_names[n]; pname = graph->output_names[n];
if (graph->n_output >= output_count) {
res = -ENOSPC;
goto error;
}
gp = &graph->output[graph->n_output]; gp = &graph->output[graph->n_output];
if (spa_streq(pname, "null")) { if (spa_streq(pname, "null")) {
gp->desc = NULL; gp->desc = NULL;