From 0a38fedeec5526f5575dc6a3672826ca14e83364 Mon Sep 17 00:00:00 2001 From: zuozhiwei Date: Mon, 20 Apr 2026 11:17:40 +0800 Subject: [PATCH 1/2] conf: clamp pw_strv_insert_at invalid pos to [0, len] Invalid pos was clamped to len+1, which could insert past the terminating NULL. Clamp negative indices to 0 and values above len to len. --- src/pipewire/conf.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/pipewire/conf.c b/src/pipewire/conf.c index c29d45648..ef0f88717 100644 --- a/src/pipewire/conf.c +++ b/src/pipewire/conf.c @@ -918,8 +918,11 @@ static char **pw_strv_insert_at(char **strv, int len, int pos, const char *str) while (strv != NULL && strv[len] != NULL) len++; } - if (pos < 0 || pos > len) - pos = len+1; + + if (pos < 0) + pos = 0; + else if (pos > len) + pos = len; n = realloc(strv, sizeof(char*) * (len + 2)); if (n == NULL) { From c5e1a3eae334a2103e1ce1b66874919f8fba1a0e Mon Sep 17 00:00:00 2001 From: zhiwei zuo <3467826908@qq.com> Date: Mon, 20 Apr 2026 09:10:11 +0000 Subject: [PATCH 2/2] Apply 1 suggestion(s) to 1 file(s) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Barnabás Pőcze --- src/pipewire/conf.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/src/pipewire/conf.c b/src/pipewire/conf.c index ef0f88717..f6dd56847 100644 --- a/src/pipewire/conf.c +++ b/src/pipewire/conf.c @@ -918,10 +918,7 @@ static char **pw_strv_insert_at(char **strv, int len, int pos, const char *str) while (strv != NULL && strv[len] != NULL) len++; } - - if (pos < 0) - pos = 0; - else if (pos > len) + if (pos < 0 || pos > len) pos = len; n = realloc(strv, sizeof(char*) * (len + 2));