From b08cfcb8832456d701681351eeed2c8231dacfa8 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Tue, 10 Mar 2026 14:25:07 +0100 Subject: [PATCH] client-node: avoid using invalid fd or mem in clear_data Don't close an -1 fd in clear_data. If we let the client allocate buffer, set our fd and data to invalid values. If the client decides to renegotiate before we get the buffer data we might otherwise try to clear the mem_id (default 0) or close the fd (also default 0). Fixes #5162 --- src/modules/module-client-node/client-node.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/modules/module-client-node/client-node.c b/src/modules/module-client-node/client-node.c index 6c2137b03..7c73586ad 100644 --- a/src/modules/module-client-node/client-node.c +++ b/src/modules/module-client-node/client-node.c @@ -264,7 +264,8 @@ static void clear_data(struct impl *impl, struct spa_data *d) case SPA_DATA_DmaBuf: case SPA_DATA_SyncObj: pw_log_debug("%p: close fd:%d", impl, (int)d->fd); - close(d->fd); + if (d->fd != -1) + close(d->fd); break; } } @@ -864,8 +865,11 @@ do_port_use_buffers(struct impl *impl, memcpy(&b->datas[j], d, sizeof(struct spa_data)); - if (flags & SPA_NODE_BUFFERS_FLAG_ALLOC) + if (flags & SPA_NODE_BUFFERS_FLAG_ALLOC) { + b->datas[j].fd = -1; + b->datas[j].data = SPA_UINT32_TO_PTR(SPA_ID_INVALID); continue; + } switch (d->type) { case SPA_DATA_DmaBuf: