mirror of
https://gitlab.freedesktop.org/pipewire/pipewire.git
synced 2025-11-17 07:00:03 -05:00
parent
8f6566422f
commit
eec5eaf8df
2 changed files with 5 additions and 4 deletions
|
|
@ -273,9 +273,9 @@ SPA_API_POD_BODY int spa_pod_is_pointer(const struct spa_pod *pod)
|
|||
SPA_API_POD_BODY int spa_pod_body_get_pointer(const struct spa_pod *pod, const void *body,
|
||||
uint32_t *type, const void **value)
|
||||
{
|
||||
struct spa_pod_pointer_body b;
|
||||
if (!spa_pod_is_pointer(pod))
|
||||
return -EINVAL;
|
||||
struct spa_pod_pointer_body b;
|
||||
SPA_POD_BODY_LOAD_FIELD_ONCE(&b, body, type);
|
||||
SPA_POD_BODY_LOAD_FIELD_ONCE(&b, body, value);
|
||||
*type = b.type;
|
||||
|
|
|
|||
|
|
@ -90,13 +90,14 @@ spa_pod_parser_read_header(struct spa_pod_parser *parser, uint32_t offset, uint3
|
|||
/* Cast to uint64_t to avoid wraparound. */
|
||||
const uint64_t long_offset = (uint64_t)offset + header_size;
|
||||
if (long_offset <= size && (offset & 7) == 0) {
|
||||
struct spa_pod *pod;
|
||||
/* a barrier around the memcpy to make sure it is not moved around or
|
||||
* duplicated after the size check below. We need to to work on shared
|
||||
* memory while there could be updates happening while we read. */
|
||||
* duplicated after the size check below. We need to work on shared
|
||||
* memory and so there could be updates happening while we read. */
|
||||
SPA_BARRIER;
|
||||
memcpy(header, SPA_PTROFF(parser->data, offset, void), header_size);
|
||||
SPA_BARRIER;
|
||||
struct spa_pod *pod = SPA_PTROFF(header, pod_offset, struct spa_pod);
|
||||
pod = SPA_PTROFF(header, pod_offset, struct spa_pod);
|
||||
/* Check that the size (rounded to the next multiple of 8) is in bounds. */
|
||||
if (long_offset + SPA_ROUND_UP_N((uint64_t)pod->size, SPA_POD_ALIGN) <= size) {
|
||||
*body = SPA_PTROFF(parser->data, long_offset, void);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue