From 3ef2b7791513f4d78b7bd5972460c81f75a2674d Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Mon, 4 May 2026 18:55:59 +0200
Subject: [PATCH] pipewire: fix some allocation errors

Also fix a string leak in the device error path.
---
 src/pipewire/filter.c      |  2 ++
 src/pipewire/impl-device.c |  6 +++++-
 src/pipewire/impl-node.c   |  5 ++++-
 src/pipewire/pipewire.c    | 12 +++++++++++-
 src/pipewire/protocol.c    |  5 +++++
 5 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/src/pipewire/filter.c b/src/pipewire/filter.c
index fa5846a1c..0dae65d9f 100644
--- a/src/pipewire/filter.c
+++ b/src/pipewire/filter.c
@@ -331,6 +331,8 @@ static struct port *alloc_port(struct filter *filter,
 	struct port *p;
 
 	p = calloc(1, sizeof(struct port) + user_data_size);
+	if (p == NULL)
+		return NULL;
 	p->filter = filter;
 	p->direction = direction;
 	p->latency[SPA_DIRECTION_INPUT] = SPA_LATENCY_INFO(SPA_DIRECTION_INPUT);
diff --git a/src/pipewire/impl-device.c b/src/pipewire/impl-device.c
index 281199519..4dd7bfa00 100644
--- a/src/pipewire/impl-device.c
+++ b/src/pipewire/impl-device.c
@@ -184,7 +184,10 @@ struct pw_impl_device *pw_context_create_device(struct pw_context *context,
 	impl->cache_params = true;
 
 	this = &impl->this;
-	this->name = strdup("device");
+	if ((this->name = strdup("device")) == NULL) {
+		res = -errno;
+		goto error_free;
+	}
 	pw_log_debug("%p: new", this);
 
 	if (properties == NULL)
@@ -210,6 +213,7 @@ struct pw_impl_device *pw_context_create_device(struct pw_context *context,
 	return this;
 
 error_free:
+	free(this->name);
 	free(impl);
 error_cleanup:
 	pw_properties_free(properties);
diff --git a/src/pipewire/impl-node.c b/src/pipewire/impl-node.c
index 385cbbb24..91534bd83 100644
--- a/src/pipewire/impl-node.c
+++ b/src/pipewire/impl-node.c
@@ -1649,7 +1649,10 @@ struct pw_impl_node *pw_context_create_node(struct pw_context *context,
 
 	this = &impl->this;
 	this->context = context;
-	this->name = strdup("node");
+	if ((this->name = strdup("node")) == NULL) {
+		res = -errno;
+		goto error_clean;
+	}
 	this->source.fd = -1;
 
 	if (properties == NULL)
diff --git a/src/pipewire/pipewire.c b/src/pipewire/pipewire.c
index 89d0518b8..f7adf6670 100644
--- a/src/pipewire/pipewire.c
+++ b/src/pipewire/pipewire.c
@@ -128,7 +128,10 @@ open_plugin(struct registry *registry,
 
 	pw_log_debug("loaded plugin:'%s'", filename);
 	plugin->ref = 1;
-	plugin->filename = strdup(filename);
+	if ((plugin->filename = strdup(filename)) == NULL) {
+		res = -errno;
+		goto error_free;
+	}
 	plugin->hnd = hnd;
 	plugin->enum_func = enum_func;
 	plugin->log_topic_enum = dlsym(hnd, SPA_LOG_TOPIC_ENUM_NAME);
@@ -139,6 +142,8 @@ open_plugin(struct registry *registry,
 
 	return plugin;
 
+error_free:
+	free(plugin);
 error_dlclose:
 	dlclose(hnd);
 error_out:
@@ -278,6 +283,11 @@ static struct spa_handle *load_spa_handle(const char *lib,
 	handle->ref = 1;
 	handle->plugin = plugin;
 	handle->factory_name = strdup(factory_name);
+	if (handle->factory_name == NULL) {
+		pthread_mutex_unlock(&support_lock);
+		res = -errno;
+		goto error_free_handle;
+	}
 	spa_list_prepend(&sup->registry.handles, &handle->link);
 
 	return &handle->handle;
diff --git a/src/pipewire/protocol.c b/src/pipewire/protocol.c
index e6ee0145a..8973e43d8 100644
--- a/src/pipewire/protocol.c
+++ b/src/pipewire/protocol.c
@@ -38,6 +38,8 @@ struct pw_protocol *pw_protocol_new(struct pw_context *context,
 
 	protocol->context = context;
 	protocol->name = strdup(name);
+	if (protocol->name == NULL)
+		goto error;
 
 	spa_list_init(&protocol->marshal_list);
 	spa_list_init(&protocol->server_list);
@@ -52,6 +54,9 @@ struct pw_protocol *pw_protocol_new(struct pw_context *context,
 	pw_log_debug("%p: Created protocol %s", protocol, name);
 
 	return protocol;
+error:
+	free(protocol);
+	return NULL;
 }
 
 SPA_EXPORT