From c534acac4615c22f12de0b8bcd050eb1d3b908d7 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Wed, 10 Apr 2024 11:08:40 +0200 Subject: [PATCH] spa: handle empty values better Make sure the properties are not empty before trying to access them. --- src/gst/gstpipewireformat.c | 12 ++++++------ src/modules/module-protocol-pulse/format.c | 3 +++ src/pipewire/stream.c | 4 ++++ 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/src/gst/gstpipewireformat.c b/src/gst/gstpipewireformat.c index f0e198bba..7ffe8e916 100644 --- a/src/gst/gstpipewireformat.c +++ b/src/gst/gstpipewireformat.c @@ -842,7 +842,7 @@ handle_id_prop (const struct spa_pod_prop *prop, const char *key, id_to_string_f uint32_t i, n_items, choice; val = spa_pod_get_values(&prop->value, &n_items, &choice); - if (val->type != SPA_TYPE_Id) + if (val->type != SPA_TYPE_Id || n_items == 0) return; id = SPA_POD_BODY(val); @@ -887,7 +887,7 @@ handle_dmabuf_prop (const struct spa_pod_prop *prop, uint64_t *mods; val = spa_pod_get_values (&prop->value, &n_fmts, &choice); - if (val->type != SPA_TYPE_Id) + if (val->type != SPA_TYPE_Id || n_fmts == 0) return; if (choice != SPA_CHOICE_None && choice != SPA_CHOICE_Enum) return; @@ -899,7 +899,7 @@ handle_dmabuf_prop (const struct spa_pod_prop *prop, } pod_modifier = spa_pod_get_values (&prop_modifier->value, &n_mods, &choice); - if (pod_modifier->type != SPA_TYPE_Long) + if (pod_modifier->type != SPA_TYPE_Long || n_mods == 0) return; if (choice != SPA_CHOICE_None && choice != SPA_CHOICE_Enum) return; @@ -991,7 +991,7 @@ handle_int_prop (const struct spa_pod_prop *prop, const char *key, GstCaps *res) uint32_t i, n_items, choice; val = spa_pod_get_values(&prop->value, &n_items, &choice); - if (val->type != SPA_TYPE_Int) + if (val->type != SPA_TYPE_Int || n_items == 0) return; ints = SPA_POD_BODY(val); @@ -1035,7 +1035,7 @@ handle_rect_prop (const struct spa_pod_prop *prop, const char *width, const char uint32_t i, n_items, choice; val = spa_pod_get_values(&prop->value, &n_items, &choice); - if (val->type != SPA_TYPE_Rectangle) + if (val->type != SPA_TYPE_Rectangle || n_items == 0) return; rect = SPA_POD_BODY(val); @@ -1088,7 +1088,7 @@ handle_fraction_prop (const struct spa_pod_prop *prop, const char *key, GstCaps uint32_t i, n_items, choice; val = spa_pod_get_values(&prop->value, &n_items, &choice); - if (val->type != SPA_TYPE_Fraction) + if (val->type != SPA_TYPE_Fraction || n_items == 0) return; fract = SPA_POD_BODY(val); diff --git a/src/modules/module-protocol-pulse/format.c b/src/modules/module-protocol-pulse/format.c index a73317f9d..8ab786b3f 100644 --- a/src/modules/module-protocol-pulse/format.c +++ b/src/modules/module-protocol-pulse/format.c @@ -687,6 +687,9 @@ static int add_int(struct format_info *info, const char *k, struct spa_pod *para if (val->type != SPA_TYPE_Int) return -ENOTSUP; + if (n_values == 0) + return -ENOENT; + values = SPA_POD_BODY(val); switch (choice) { diff --git a/src/pipewire/stream.c b/src/pipewire/stream.c index 704829d5f..eeff0d3c7 100644 --- a/src/pipewire/stream.c +++ b/src/pipewire/stream.c @@ -1285,6 +1285,10 @@ static int node_event_param(void *object, int seq, } pod = spa_pod_get_values(type, &n_vals, &choice); + if (n_vals == 0) { + free(c); + return -EINVAL; + } c->type = SPA_POD_TYPE(pod); if (spa_pod_is_float(pod))