mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-10-31 22:25:38 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pod: remove alignment checks

Browse source 
We currently often create pods in a uint8_t buffer, which is not aligned
to 8 and might cause deref and other problems.

We should either align the buffer we write into or maybe make the
builder add some padding before the buffer to align it. We have to be
careful with that when we assume the buffer start is the beginning of
the pod..

Fixes #4794
This commit is contained in:
Wim Taymans 2025-07-10 16:53:39 +02:00
parent 20a4aa8cf9
commit a188f1d29f
2 changed files with 4 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
spa/include/spa/pod/iter.h
View file

@ -35,8 +35,7 @@ struct spa_pod_frame {
};
#define SPA_POD_IS_VALID(pod) \
(SPA_POD_BODY_SIZE(pod) < SPA_POD_MAX_SIZE && \
SPA_IS_ALIGNED(pod, SPA_POD_ALIGN))
(SPA_POD_BODY_SIZE(pod) < SPA_POD_MAX_SIZE)
#define SPA_POD_CHECK_TYPE(pod,_type) \
(SPA_POD_IS_VALID(pod) && \
@ -50,7 +49,7 @@ SPA_API_POD_ITER bool spa_pod_is_inside(const void *pod, uint32_t size, const vo
size_t remaining;
return spa_ptr_type_inside(pod, size, iter, struct spa_pod, &remaining) &&
SPA_IS_ALIGNED(iter, SPA_POD_ALIGN) && remaining >= SPA_POD_BODY_SIZE(iter);
remaining >= SPA_POD_BODY_SIZE(iter);
}
SPA_API_POD_ITER void *spa_pod_next(const void *iter)

6
spa/include/spa/pod/parser.h
View file

@ -76,11 +76,9 @@ spa_pod_parser_deref(struct spa_pod_parser *parser, uint32_t offset, uint32_t si
/* Use void* because creating a misaligned pointer is undefined. */
void *pod = SPA_PTROFF(parser->data, offset, void);
/*
* Check that the pointer is aligned and that the size (rounded
* to the next multiple of 8) is in bounds.
* Check that the size (rounded to the next multiple of 8) is in bounds.
*/
if (SPA_IS_ALIGNED(pod, SPA_POD_ALIGN) &&
long_offset + SPA_ROUND_UP_N((uint64_t)SPA_POD_BODY_SIZE(pod), SPA_POD_ALIGN) <= size)
if (long_offset + SPA_ROUND_UP_N((uint64_t)SPA_POD_BODY_SIZE(pod), SPA_POD_ALIGN) <= size)
return (struct spa_pod *)pod;
}
return NULL;