mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-28 06:46:42 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

milan-avb: guard against size_t underflow on short packets in unsol reply prepare

Browse source
This commit is contained in:
hackerman-kl 2026-04-19 18:58:01 +02:00
parent 09f9100ce7
commit e6b4de6442
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/modules/module-avb/aecp-aem-cmds-resps/reply-unsol-helpers.c
View file

@ -111,6 +111,9 @@ static void reply_unsol_notifications_prepare(struct aecp *aecp,
/* Here the value of 12 is the delta between the target_entity_id and /* Here the value of 12 is the delta between the target_entity_id and
start of the AECP message specific data. */ start of the AECP message specific data. */
if (len < sizeof(*h) + sizeof(*p))
ctrl_data_length = AVB_PACKET_CONTROL_DATA_OFFSET;
else
ctrl_data_length = len - (sizeof(*h) + sizeof(*p)) ctrl_data_length = len - (sizeof(*h) + sizeof(*p))
+ AVB_PACKET_CONTROL_DATA_OFFSET; + AVB_PACKET_CONTROL_DATA_OFFSET;