mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-30 06:46:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: add missing NULL checks after strdup in data-loop

Browse source 
Memory Safety: Medium

In pw_data_loop construction, strdup() calls for the thread affinity
and class strings were not checked for failure. A failed strdup()
would store NULL, leading to NULL pointer dereferences when these
strings are later used for thread configuration.

Fix by checking strdup() return values and failing initialization
with -ENOMEM on allocation failure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-28 13:19:54 +02:00
parent 382533da96
commit 640af6b20f
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/pipewire/data-loop.c
View file

@ -121,8 +121,13 @@ static struct pw_data_loop *loop_new(struct pw_loop *loop, const struct spa_dict
this->rt_prio = atoi(str); this->rt_prio = atoi(str);
if ((str = spa_dict_lookup(props, SPA_KEY_THREAD_NAME)) != NULL) if ((str = spa_dict_lookup(props, SPA_KEY_THREAD_NAME)) != NULL)
name = str; name = str;
if ((str = spa_dict_lookup(props, SPA_KEY_THREAD_AFFINITY)) != NULL) if ((str = spa_dict_lookup(props, SPA_KEY_THREAD_AFFINITY)) != NULL) {
this->affinity = strdup(str); this->affinity = strdup(str);
if (this->affinity == NULL) {
res = -ENOMEM;
goto error_free;
}
}
if ((str = spa_dict_lookup(props, SPA_KEY_THREAD_RESET_ON_FORK)) != NULL) if ((str = spa_dict_lookup(props, SPA_KEY_THREAD_RESET_ON_FORK)) != NULL)
this->reset_on_fork = spa_atob(str); this->reset_on_fork = spa_atob(str);
} }
@ -132,6 +137,10 @@ static struct pw_data_loop *loop_new(struct pw_loop *loop, const struct spa_dict
name = "data-loop"; name = "data-loop";
this->class = strdup(class); this->class = strdup(class);
if (this->class == NULL) {
res = -ENOMEM;
goto error_free;
}
this->classes = pw_strv_parse(class, strlen(class), INT_MAX, NULL); this->classes = pw_strv_parse(class, strlen(class), INT_MAX, NULL);
if (!this->loop->name[0]) if (!this->loop->name[0])
pw_loop_set_name(this->loop, name); pw_loop_set_name(this->loop, name);