mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-28 06:46:42 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

module-avb: bound packet copy length in get-set-name handlers

Browse source
This commit is contained in:
hackerman-kl 2026-04-20 18:29:56 +02:00
parent e6b4de6442
commit a8832c74d0
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/modules/module-avb/aecp-aem-cmds-resps/cmd-get-set-name.c
View file

@ -2,6 +2,7 @@
/* SPDX-FileCopyrightText: Copyright © 2025 Alexandre Malki <alexandre.malki@kebag-logic.com> */ /* SPDX-FileCopyrightText: Copyright © 2025 Alexandre Malki <alexandre.malki@kebag-logic.com> */
/* SPDX-License-Identifier: MIT */ /* SPDX-License-Identifier: MIT */
#include <errno.h>
#include <limits.h> #include <limits.h>
#include <stdbool.h> #include <stdbool.h>
#include <inttypes.h> #include <inttypes.h>
@ -73,6 +74,9 @@ static int send_unsol_name(struct aecp *aecp,
uint8_t unsol_buf[512]; uint8_t unsol_buf[512];
struct aecp_aem_base_info info = { 0 }; struct aecp_aem_base_info info = { 0 };
if (len < 0 || (size_t)len > sizeof(unsol_buf))
return -EINVAL;
memcpy(unsol_buf, msg, len); memcpy(unsol_buf, msg, len);
info.controller_entity_id = htobe64(p->aecp.controller_guid); info.controller_entity_id = htobe64(p->aecp.controller_guid);
info.expire_timeout = INT64_MAX; info.expire_timeout = INT64_MAX;
@ -114,6 +118,11 @@ int handle_cmd_get_name_common(struct aecp *aecp, int64_t now,
return reply_status(aecp, return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len); AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
if (len < 0 || (size_t)len > sizeof(buf) ||
(size_t)len < sizeof(*h) + sizeof(*p) + sizeof(*cmd))
return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
memcpy(buf, m, len); memcpy(buf, m, len);
h_reply = (struct avb_ethernet_header *)buf; h_reply = (struct avb_ethernet_header *)buf;
p_reply = SPA_PTROFF(h_reply, sizeof(*h_reply), void); p_reply = SPA_PTROFF(h_reply, sizeof(*h_reply), void);
@ -162,6 +171,10 @@ int handle_cmd_set_name_common(struct aecp *aecp, int64_t now,
return reply_status(aecp, return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len); AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
if (len < 0 || (size_t)len < sizeof(*h) + sizeof(*p) + sizeof(*cmd))
return reply_status(aecp,
AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
/** /**
* IEEE 1722.1-2021: 7.4.17.1: The name does not contain a trailing NULL * IEEE 1722.1-2021: 7.4.17.1: The name does not contain a trailing NULL
* but if the name is less than 64 bytes in length then it is zero * but if the name is less than 64 bytes in length then it is zero