mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-25 06:46:40 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: fix missing malloc NULL checks in pffft

Browse source 
Memory Safety: Medium

In new_setup_simd(), the return value of malloc() for the PFFFT_Setup
struct was not checked before dereferencing. Similarly,
pffft_aligned_malloc() for the data buffer was not checked. If either
allocation fails, the code dereferences NULL causing a crash.

Add NULL checks for both allocations, freeing previously allocated
memory on failure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-23 16:44:42 +02:00
parent 2ccb8a7d88
commit e75f72476b
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
spa/plugins/filter-graph/pffft.c
View file

@ -1419,6 +1419,8 @@ static PFFFT_Setup *new_setup_simd(int N, pffft_transform_t transform)
/* unfortunately, the fft size must be a multiple of 16 for complex FFTs /* unfortunately, the fft size must be a multiple of 16 for complex FFTs
and 32 for real FFTs -- a lot of stuff would need to be rewritten to and 32 for real FFTs -- a lot of stuff would need to be rewritten to
handle other cases (or maybe just switch to a scalar fft, I don't know..) */ handle other cases (or maybe just switch to a scalar fft, I don't know..) */
if (s == NULL)
return NULL;
if (transform == PFFFT_REAL) { if (transform == PFFFT_REAL) {
assert((N % (2 * SIMD_SZ * SIMD_SZ)) == 0 && N > 0); assert((N % (2 * SIMD_SZ * SIMD_SZ)) == 0 && N > 0);
} }
@ -1431,6 +1433,10 @@ static PFFFT_Setup *new_setup_simd(int N, pffft_transform_t transform)
/* nb of complex simd vectors */ /* nb of complex simd vectors */
s->Ncvec = (transform == PFFFT_REAL ? N / 2 : N) / SIMD_SZ; s->Ncvec = (transform == PFFFT_REAL ? N / 2 : N) / SIMD_SZ;
s->data = (v4sf *) pffft_aligned_malloc(2 * s->Ncvec * sizeof(v4sf)); s->data = (v4sf *) pffft_aligned_malloc(2 * s->Ncvec * sizeof(v4sf));
if (s->data == NULL) {
free(s);
return NULL;
}
s->e = (float *)s->data; s->e = (float *)s->data;
s->twiddle = s->twiddle =
(float *)(s->data + (2 * s->Ncvec * (SIMD_SZ - 1)) / SIMD_SZ); (float *)(s->data + (2 * s->Ncvec * (SIMD_SZ - 1)) / SIMD_SZ);