From 86ca0f8466f1f3726c67a24095d278b7707f9132 Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Thu, 4 Nov 2021 16:41:32 +0100
Subject: [PATCH] acp: improve debug of channel map

Increase the size of the channel_map debug printf buffer.
Use a safer version of the snprintf that avoids buffer overruns.

See #1781
---
 spa/plugins/alsa/acp/channelmap.h             |  2 +-
 spa/plugins/alsa/acp/compat.h                 | 39 ++++++++++++++++++-
 .../modules/module-zeroconf-publish.c         |  4 +-
 3 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/spa/plugins/alsa/acp/channelmap.h b/spa/plugins/alsa/acp/channelmap.h
index 2eb306986..44284e2f3 100644
--- a/spa/plugins/alsa/acp/channelmap.h
+++ b/spa/plugins/alsa/acp/channelmap.h
@@ -29,7 +29,7 @@ extern "C" {
 
 #define PA_CHANNELS_MAX	64
 
-#define PA_CHANNEL_MAP_SNPRINT_MAX 336
+#define PA_CHANNEL_MAP_SNPRINT_MAX (PA_CHANNELS_MAX * 32)
 
 typedef enum pa_channel_map_def {
     PA_CHANNEL_MAP_AIFF,
diff --git a/spa/plugins/alsa/acp/compat.h b/spa/plugins/alsa/acp/compat.h
index 148b5058e..929675d13 100644
--- a/spa/plugins/alsa/acp/compat.h
+++ b/spa/plugins/alsa/acp/compat.h
@@ -280,7 +280,44 @@ static inline PA_PRINTF_FUNC(5, 6) void pa_log_level_meta(enum pa_log_level leve
 #define pa_strnull(s)	((s) ? (s) : "null")
 #define pa_startswith(s,pfx)	(strstr(s, pfx) == s)
 
-#define pa_snprintf	snprintf
+PA_PRINTF_FUNC(3, 0)
+static inline size_t pa_vsnprintf(char *str, size_t size, const char *format, va_list ap)
+{
+	int ret;
+
+	pa_assert(str);
+	pa_assert(size > 0);
+	pa_assert(format);
+
+	ret = vsnprintf(str, size, format, ap);
+
+	str[size-1] = 0;
+
+	if (ret < 0)
+		return strlen(str);
+
+	if ((size_t) ret > size-1)
+		return size-1;
+
+	return (size_t) ret;
+}
+
+PA_PRINTF_FUNC(3, 4)
+static inline size_t pa_snprintf(char *str, size_t size, const char *format, ...)
+{
+	size_t ret;
+	va_list ap;
+
+	pa_assert(str);
+	pa_assert(size > 0);
+	pa_assert(format);
+
+	va_start(ap, format);
+	ret = pa_vsnprintf(str, size, format, ap);
+	va_end(ap);
+
+	return ret;
+}
 
 #define pa_xstrdup(s)		((s) != NULL ? strdup(s) : NULL)
 #define pa_xstrndup(s,n)	((s) != NULL ? strndup(s,n) : NULL)
diff --git a/src/modules/module-protocol-pulse/modules/module-zeroconf-publish.c b/src/modules/module-protocol-pulse/modules/module-zeroconf-publish.c
index 076f1aed2..b40c4042a 100644
--- a/src/modules/module-protocol-pulse/modules/module-zeroconf-publish.c
+++ b/src/modules/module-protocol-pulse/modules/module-zeroconf-publish.c
@@ -224,7 +224,7 @@ static char* channel_map_snprint(char *s, size_t l, const struct channel_map *ma
 	*(e = s) = 0;
 
 	for (channel = 0; channel < map->channels && l > 1; channel++) {
-		l -= snprintf(e, l, "%s%s",
+		l -= spa_scnprintf(e, l, "%s%s",
 				first ? "" : ",",
 				channel_id2paname(map->map[channel], &aux));
 
@@ -381,7 +381,7 @@ static void service_entry_group_callback(AvahiEntryGroup *g, AvahiEntryGroupStat
 	}
 }
 
-#define PA_CHANNEL_MAP_SNPRINT_MAX 336
+#define PA_CHANNEL_MAP_SNPRINT_MAX (CHANNELS_MAX * 32)
 
 static void publish_service(struct service *s)
 {