diff --git a/pipewire-v4l2/src/pipewire-v4l2.c b/pipewire-v4l2/src/pipewire-v4l2.c index a832ceef6..e8efa60e5 100644 --- a/pipewire-v4l2/src/pipewire-v4l2.c +++ b/pipewire-v4l2/src/pipewire-v4l2.c @@ -2256,7 +2256,7 @@ static int vidioc_queryctrl(struct file *file, struct v4l2_queryctrl *arg) // check type and populate range pod = spa_pod_get_values(type, &n_vals, &choice); if (pod->type == SPA_TYPE_Int) { - if (n_vals < 4) + if (pod->size != sizeof(int) || n_vals < 4) break; arg->type = V4L2_CTRL_TYPE_INTEGER; int *v = SPA_POD_BODY(pod); diff --git a/spa/plugins/v4l2/v4l2-utils.c b/spa/plugins/v4l2/v4l2-utils.c index 9cfd0afae..26effd8a8 100644 --- a/spa/plugins/v4l2/v4l2-utils.c +++ b/spa/plugins/v4l2/v4l2-utils.c @@ -399,7 +399,7 @@ enum_filter_format(uint32_t media_type, int32_t media_subtype, if (index == 0) video_format = values[0]; } else { - if (index < n_values - 1) + if (index < n_values - 1 && val->size == sizeof(values[0])) video_format = values[index + 1]; } } else { diff --git a/src/gst/gstpipewireformat.c b/src/gst/gstpipewireformat.c index 20b93065a..30f646382 100644 --- a/src/gst/gstpipewireformat.c +++ b/src/gst/gstpipewireformat.c @@ -1117,7 +1117,7 @@ handle_int_prop (const struct spa_pod_prop *prop, const char *key, GstCaps *res) case SPA_CHOICE_Range: case SPA_CHOICE_Step: { - if (n_items < 3) + if (n_items < 3 || val->size != sizeof(ints[0])) return; gst_caps_set_simple (res, key, GST_TYPE_INT_RANGE, ints[1], ints[2], NULL); break; @@ -1225,7 +1225,7 @@ handle_fraction_prop (const struct spa_pod_prop *prop, const char *key, GstCaps case SPA_CHOICE_Range: case SPA_CHOICE_Step: { - if (n_items < 3) + if (n_items < 3 || val->size != sizeof(fract[0])) return; if (fract[1].num == fract[2].num && diff --git a/src/modules/module-protocol-pulse/format.c b/src/modules/module-protocol-pulse/format.c index 34a835ef8..2cb965695 100644 --- a/src/modules/module-protocol-pulse/format.c +++ b/src/modules/module-protocol-pulse/format.c @@ -683,7 +683,7 @@ static int add_int(struct format_info *info, const char *k, struct spa_pod *para return -ENOENT; val = spa_pod_get_values(&prop->value, &n_values, &choice); - if (val->type != SPA_TYPE_Int) + if (val->type != SPA_TYPE_Int || val->size != sizeof(values[0])) return -ENOTSUP; if (n_values == 0) @@ -745,7 +745,7 @@ static int format_info_iec958_from_param(struct format_info *info, struct spa_po return -ENOENT; val = spa_pod_get_values(&prop->value, &n_values, &choice); - if (val->type != SPA_TYPE_Id) + if (val->type != SPA_TYPE_Id || val->size != sizeof(values[0])) return -ENOTSUP; if (index >= n_values) diff --git a/src/pipewire/stream.c b/src/pipewire/stream.c index 904e44a67..530382fac 100644 --- a/src/pipewire/stream.c +++ b/src/pipewire/stream.c @@ -1276,6 +1276,10 @@ static int node_event_param(void *object, int seq, free(c); return -EINVAL; } + if (n_vals > 1 && pod->size != spa_pod_type_size(pod->type)) { + free(c); + return -ENOTSUP; + } c->type = pod->type; if (spa_pod_is_float(pod))