From 7ecd51dc80262526d16560373c0c76408dfd946f Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Tue, 10 Mar 2026 14:25:07 +0100 Subject: [PATCH] client-node: avoid using invalid fd or mem in clear_data Don't close an -1 fd in clear_data. If we let the client allocate buffer, set our fd and data to invalid values. If the client decides to renegotiate before we get the buffer data we might otherwise try to clear the mem_id (default 0) or close the fd (also default 0). Fixes #5162 --- src/modules/module-client-node/client-node.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/modules/module-client-node/client-node.c b/src/modules/module-client-node/client-node.c index 9bf1c798b..bd9a1dde2 100644 --- a/src/modules/module-client-node/client-node.c +++ b/src/modules/module-client-node/client-node.c @@ -263,7 +263,8 @@ static void clear_data(struct impl *impl, struct spa_data *d) case SPA_DATA_DmaBuf: case SPA_DATA_SyncObj: pw_log_debug("%p: close fd:%d", impl, (int)d->fd); - close(d->fd); + if (d->fd != -1) + close(d->fd); break; } } @@ -865,8 +866,11 @@ do_port_use_buffers(struct impl *impl, memcpy(&b->datas[j], d, sizeof(struct spa_data)); - if (flags & SPA_NODE_BUFFERS_FLAG_ALLOC) + if (flags & SPA_NODE_BUFFERS_FLAG_ALLOC) { + b->datas[j].fd = -1; + b->datas[j].data = SPA_UINT32_TO_PTR(SPA_ID_INVALID); continue; + } switch (d->type) { case SPA_DATA_DmaBuf: