security: add total sample cache size limit in PulseAudio protocol

There was no limit on the total size of the sample cache. A client
could upload many samples to exhaust server memory. Add a configurable
pulse.max-sample-cache property (default 64MB) to cap the total size
of all cached samples.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-29 16:39:57 +02:00
parent 37990b5e90
commit 52afec565b
5 changed files with 18 additions and 0 deletions

View file

@ -77,6 +77,7 @@
* #pulse.default.position = [ FL FR ]
* #pulse.idle.timeout = 0
* #pulse.max-streams = 64
* #pulse.max-sample-cache = 67108864
* }
*
* pulse.properties.rules = [
@ -254,6 +255,13 @@
*
* The maximum number of streams a single client can create. Default is 64.
*
*\code{.unparsed}
* pulse.max-sample-cache = 67108864
*\endcode
*
* The maximum total size in bytes of all sample cache entries. Default is
* 67108864 (64MB).
*
* ## Command execution
*
* As part of the server startup sequence, a set of commands can be executed.