mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-27 06:46:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

milan-avb: guard against size_t underflow on short packets in unsol reply prepare

Browse source
This commit is contained in:
hackerman-kl 2026-04-19 18:58:01 +02:00
parent 09f9100ce7
commit e6b4de6442
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/modules/module-avb/aecp-aem-cmds-resps/reply-unsol-helpers.c
View file

@ -111,8 +111,11 @@ static void reply_unsol_notifications_prepare(struct aecp *aecp,
/* Here the value of 12 is the delta between the target_entity_id and
start of the AECP message specific data. */
ctrl_data_length = len - (sizeof(*h) + sizeof(*p))
+ AVB_PACKET_CONTROL_DATA_OFFSET;
if (len < sizeof(*h) + sizeof(*p))
ctrl_data_length = AVB_PACKET_CONTROL_DATA_OFFSET;
else
ctrl_data_length = len - (sizeof(*h) + sizeof(*p))
+ AVB_PACKET_CONTROL_DATA_OFFSET;
h = (struct avb_ethernet_header*) packet;
p = SPA_PTROFF(h, sizeof(*h), void);