mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-10 08:21:03 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

module-avb: fix potential NULL pointer dereference in MSRP/MVRP notify

Browse source 
The msrp_notify() and mvrp_notify() functions call dispatch table
notify callbacks without checking for NULL. In MSRP, the
TALKER_FAILED attribute type has a NULL notify callback, which would
crash if a talker-failed attribute received a registrar state change
notification (e.g. RX_NEW triggering NOTIFY_NEW).

Add NULL checks before calling the dispatch notify callbacks, matching
the defensive pattern used in the encode path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Christian F.K. Schaller 2026-04-07 07:24:34 -04:00 • committed by Wim Taymans
parent bdaecfebb8
commit ef8f820d4a
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/modules/module-avb/mvrp.c
View file

@ -171,7 +171,8 @@ static void mvrp_notify(void *data, uint64_t now, uint8_t notify)
{
struct attr *a = data;
struct mvrp *mvrp = a->mvrp;
return dispatch[a->attr.type].notify(mvrp, now, a, notify);
if (dispatch[a->attr.type].notify)
dispatch[a->attr.type].notify(mvrp, now, a, notify);
}
static const struct avb_mrp_attribute_events mrp_attr_events = {