security: add per-client stream limit in PulseAudio protocol

There was no limit on the number of streams a single client could
create. Each stream allocates a 4MB ring buffer, allowing a malicious
client to exhaust server memory. Add a configurable pulse.max-streams
property (default 64) to limit streams per client.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-29 16:28:05 +02:00
parent 80ec1f1d10
commit 37990b5e90
7 changed files with 18 additions and 1 deletions

View file

@ -119,6 +119,7 @@ pulse.properties = {
#pulse.default.tlength = 96000/48000 # 2 seconds
#pulse.min.quantum = 256/48000 # 5.3ms
#pulse.idle.timeout = 0 # don't pause after underruns
#pulse.max-streams = 64 # max streams per client
#pulse.default.format = F32
#pulse.default.position = [ FL FR ]
}