mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-27 06:46:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: fix integer overflow in Bluetooth codec codesize calculations

Browse source 
Memory Safety: High

Several Bluetooth audio codec implementations calculate codesize by
multiplying samples * channels * sizeof(sample_type) without overflow
checks. The parameters come from Bluetooth codec negotiation, which is
influenced by the remote peer. If the multiplication overflows, codesize
wraps to a small value, causing subsequent buffer size checks to pass
while the actual data processing operates on the full (larger) sample
count, leading to heap buffer overflows.

Affected codecs: LC3 (BAP), LC3plus (A2DP), Opus (A2DP), Opus-G (A2DP).

Add overflow checks before each codesize multiplication to ensure the
result fits in the target integer type, returning -EINVAL on overflow.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-23 18:50:14 +02:00
parent 00413a3263
commit e3e1c4d214
4 changed files with 30 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
spa/plugins/bluez5/bap-codec-lc3.c
View file

@ -1299,7 +1299,20 @@ static void *codec_init(const struct media_codec *codec, uint32_t flags,
goto error;
}
this->samples = res;
this->codesize = (size_t)this->samples * this->channels * conf.n_blks * sizeof(int32_t);
{
size_t cs = (size_t)this->samples * this->channels;
if (this->channels > 0 && cs / this->channels != (size_t)this->samples) {
res = -EINVAL;
goto error;
}
cs *= conf.n_blks;
cs *= sizeof(int32_t);
if (cs > UINT_MAX) {
res = -EINVAL;
goto error;
}
this->codesize = cs;
}
if (!(flags & MEDIA_CODEC_FLAG_SINK)) {
for (ich = 0; ich < this->channels; ich++) {