From 55f6c35e7801a16cdd789f40515c69ba6beec622 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Tue, 10 Mar 2026 14:25:07 +0100 Subject: [PATCH] client-node: avoid using invalid fd or mem in clear_data Don't close an -1 fd in clear_data. If we let the client allocate buffer, set our fd and data to invalid values. If the client decides to renegotiate before we get the buffer data we might otherwise try to clear the mem_id (default 0) or close the fd (also default 0). Fixes #5162 --- src/modules/module-client-node/client-node.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/modules/module-client-node/client-node.c b/src/modules/module-client-node/client-node.c index 0253591cf..9740e1c89 100644 --- a/src/modules/module-client-node/client-node.c +++ b/src/modules/module-client-node/client-node.c @@ -264,7 +264,8 @@ static void clear_data(struct impl *impl, struct spa_data *d) case SPA_DATA_DmaBuf: case SPA_DATA_SyncObj: pw_log_debug("%p: close fd:%d", impl, (int)d->fd); - close(d->fd); + if (d->fd != -1) + close(d->fd); break; } } @@ -864,8 +865,11 @@ do_port_use_buffers(struct impl *impl, memcpy(&b->datas[j], d, sizeof(struct spa_data)); - if (flags & SPA_NODE_BUFFERS_FLAG_ALLOC) + if (flags & SPA_NODE_BUFFERS_FLAG_ALLOC) { + b->datas[j].fd = -1; + b->datas[j].data = SPA_UINT32_TO_PTR(SPA_ID_INVALID); continue; + } switch (d->type) { case SPA_DATA_DmaBuf: