mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-05-03 06:47:04 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: add missing create_tag checks in stream command handlers

Browse source 
do_cork_stream, do_flush_trigger_prebuf_stream, and do_set_stream_name
did not check whether the stream had completed format negotiation.
Add create_tag guards matching the pattern in do_set_stream_buffer_attr.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-29 18:26:01 +02:00
parent 6d2600c09d
commit d4a1278018
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/modules/module-protocol-pulse/pulse-server.c
View file

@ -2707,6 +2707,8 @@ static int do_cork_stream(struct client *client, uint32_t command, uint32_t tag,
stream = pw_map_lookup(&client->streams, channel);
if (stream == NULL || stream->type == STREAM_TYPE_UPLOAD)
return -ENOENT;
if (stream->create_tag != SPA_ID_INVALID)
return -ENOENT;
stream_set_corked(stream, cork);
if (cork) {
@ -2737,6 +2739,8 @@ static int do_flush_trigger_prebuf_stream(struct client *client, uint32_t comman
stream = pw_map_lookup(&client->streams, channel);
if (stream == NULL || stream->type == STREAM_TYPE_UPLOAD)
return -ENOENT;
if (stream->create_tag != SPA_ID_INVALID)
return -ENOENT;
switch (command) {
case COMMAND_FLUSH_PLAYBACK_STREAM:
@ -3238,6 +3242,8 @@ static int do_set_stream_name(struct client *client, uint32_t command, uint32_t
stream = pw_map_lookup(&client->streams, channel);
if (stream == NULL || stream->type == STREAM_TYPE_UPLOAD)
return -ENOENT;
if (stream->create_tag != SPA_ID_INVALID)
return -ENOENT;
items[0] = SPA_DICT_ITEM_INIT(PW_KEY_MEDIA_NAME, name);
pw_stream_update_properties(stream->stream,