From 67b70c8d23bb831b36c172eed258c82e490b8904 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Mon, 4 May 2026 10:13:44 +0200 Subject: [PATCH] netjack2: do some sanity checks on the MTU It needs to be large enough foer the header, udp overhead and a uint32_t for each audio channel to be able to send the sync packet. Avoid string oob read when debugging the packet. --- src/modules/module-netjack2/packets.h | 2 +- src/modules/module-netjack2/peer.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/modules/module-netjack2/packets.h b/src/modules/module-netjack2/packets.h index c7e92fc62..dc530d041 100644 --- a/src/modules/module-netjack2/packets.h +++ b/src/modules/module-netjack2/packets.h @@ -133,7 +133,7 @@ struct nj2_packet_header { static inline void nj2_dump_packet_header(struct nj2_packet_header *header) { - pw_log_info("Type: %s", header->type); + pw_log_info("Type: %.*s", (int)sizeof(header->type), header->type); pw_log_info("Data Type: %c", ntohl(header->data_type)); pw_log_info("Data Stream: %c", ntohl(header->data_stream)); pw_log_info("ID: %u", ntohl(header->id)); diff --git a/src/modules/module-netjack2/peer.c b/src/modules/module-netjack2/peer.c index ba2e10741..3a69a083c 100644 --- a/src/modules/module-netjack2/peer.c +++ b/src/modules/module-netjack2/peer.c @@ -156,6 +156,12 @@ static int netjack2_init(struct netjack2_peer *peer) errno = EINVAL; goto error_errno; } + if (peer->params.mtu < UDP_HEADER_SIZE + sizeof(struct nj2_packet_header) || + sizeof(struct nj2_packet_header) + + peer->params.recv_audio_channels * sizeof(int32_t) > peer->params.mtu) { + errno = EINVAL; + goto error_errno; + } if (peer->params.sample_encoder == NJ2_ENCODER_INT) { if (spa_overflow_mul(peer->params.period_size, (uint32_t)sizeof(int16_t), &peer->max_encoded_size) ||