mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-11-03 09:01:54 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

fmtconvert: check bounds on chunk offset/size

Browse source
This commit is contained in:
Wim Taymans 2019-01-25 13:26:39 +01:00
parent 58f3146b60
commit 30ecf66561
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
spa/plugins/audioconvert/fmtconvert.c
View file

@ -828,7 +828,7 @@ static int impl_node_process(struct spa_node *node)
void **dst_datas; void **dst_datas;
uint32_t i, n_src_datas, n_dst_datas; uint32_t i, n_src_datas, n_dst_datas;
int res = 0; int res = 0;
uint32_t n_samples, size, maxsize; uint32_t n_samples, size, maxsize, offs;
spa_return_val_if_fail(node != NULL, -EINVAL); spa_return_val_if_fail(node != NULL, -EINVAL);
@ -869,8 +869,9 @@ static int impl_node_process(struct spa_node *node)
size = UINT32_MAX; size = UINT32_MAX;
for (i = 0; i < n_src_datas; i++) { for (i = 0; i < n_src_datas; i++) {
size = SPA_MIN(size, inb->datas[0].chunk->size); offs = SPA_MIN(inb->datas[i].chunk->offset, inb->datas[i].maxsize);
src_datas[i] = SPA_MEMBER(inb->datas[i].data, inb->datas[i].chunk->offset, void); size = SPA_MIN(size, SPA_MIN(inb->datas[i].maxsize - offs, inb->datas[i].chunk->size));
src_datas[i] = SPA_MEMBER(inb->datas[i].data, offs, void);
} }
n_samples = size / inport->stride; n_samples = size / inport->stride;