mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-05-05 06:46:28 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

netjack2: do some sanity checks on the MTU

Browse source 
It needs to be large enough foer the header, udp overhead and a uint32_t
for each audio channel to be able to send the sync packet.

Avoid string oob read when debugging the packet.
This commit is contained in:
Wim Taymans 2026-05-04 10:13:44 +02:00
parent 5a8a3b5a54
commit 67b70c8d23
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/modules/module-netjack2/packets.h
View file

@ -133,7 +133,7 @@ struct nj2_packet_header {
static inline void nj2_dump_packet_header(struct nj2_packet_header *header) static inline void nj2_dump_packet_header(struct nj2_packet_header *header)
{ {
pw_log_info("Type: %s", header->type); pw_log_info("Type: %.*s", (int)sizeof(header->type), header->type);
pw_log_info("Data Type: %c", ntohl(header->data_type)); pw_log_info("Data Type: %c", ntohl(header->data_type));
pw_log_info("Data Stream: %c", ntohl(header->data_stream)); pw_log_info("Data Stream: %c", ntohl(header->data_stream));
pw_log_info("ID: %u", ntohl(header->id)); pw_log_info("ID: %u", ntohl(header->id));

6
src/modules/module-netjack2/peer.c
View file

@ -156,6 +156,12 @@ static int netjack2_init(struct netjack2_peer *peer)
errno = EINVAL; errno = EINVAL;
goto error_errno; goto error_errno;
} }
if (peer->params.mtu < UDP_HEADER_SIZE + sizeof(struct nj2_packet_header) ||
sizeof(struct nj2_packet_header) +
peer->params.recv_audio_channels * sizeof(int32_t) > peer->params.mtu) {
errno = EINVAL;
goto error_errno;
}
if (peer->params.sample_encoder == NJ2_ENCODER_INT) { if (peer->params.sample_encoder == NJ2_ENCODER_INT) {
if (spa_overflow_mul(peer->params.period_size, (uint32_t)sizeof(int16_t), &peer->max_encoded_size) || if (spa_overflow_mul(peer->params.period_size, (uint32_t)sizeof(int16_t), &peer->max_encoded_size) ||