mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-28 06:46:42 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

milan-avb: bound packet copy length in clock-source handlers

Browse source
This commit is contained in:
hackerman-kl 2026-04-16 19:07:59 +02:00
parent d1deabe5ac
commit f06234fda8
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/modules/module-avb/aecp-aem-cmds-resps/cmd-get-set-clock-source.c
View file

@ -3,6 +3,7 @@
/* SPDX-FileCopyrightText: Copyright © 2025 Alexandre Malki <alexandre.malki@kebag-logic.com> */ /* SPDX-FileCopyrightText: Copyright © 2025 Alexandre Malki <alexandre.malki@kebag-logic.com> */
/* SPDX-License-Identifier: MIT */ /* SPDX-License-Identifier: MIT */
#include <errno.h>
#include <stdint.h> #include <stdint.h>
#include <stdbool.h> #include <stdbool.h>
@ -23,6 +24,9 @@ static int reply_invalid_clock_source(struct aecp *aecp,
struct avb_packet_aecp_aem *p = SPA_PTROFF(h, sizeof(*h), void); struct avb_packet_aecp_aem *p = SPA_PTROFF(h, sizeof(*h), void);
struct avb_packet_aecp_aem_setget_clock_source *sclk_source; struct avb_packet_aecp_aem_setget_clock_source *sclk_source;
if (len < 0 || (size_t)len > sizeof(buf))
return reply_status(aecp, AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
memcpy(buf, m, len); memcpy(buf, m, len);
sclk_source = sclk_source =
(struct avb_packet_aecp_aem_setget_clock_source *) p->payload; (struct avb_packet_aecp_aem_setget_clock_source *) p->payload;
@ -41,6 +45,9 @@ static int handle_unsol_set_clock_source(struct aecp *aecp, struct descriptor *d
struct aecp_aem_base_info bi = { 0 }; struct aecp_aem_base_info bi = { 0 };
int rc; int rc;
if (len < 0 || (size_t)len > sizeof(buf))
return -EINVAL;
memcpy(buf, m, len); memcpy(buf, m, len);
bi.controller_entity_id = htobe64(ctrler_id); bi.controller_entity_id = htobe64(ctrler_id);
bi.expire_timeout = INT64_MAX; bi.expire_timeout = INT64_MAX;
@ -67,6 +74,9 @@ int handle_cmd_get_clock_source_milan_v12(struct aecp *aecp, int64_t now,
uint16_t desc_index; uint16_t desc_index;
uint16_t desc_type; uint16_t desc_type;
if (len < 0 || (size_t)len > sizeof(buf))
return reply_status(aecp, AVB_AECP_AEM_STATUS_BAD_ARGUMENTS, m, len);
memcpy(buf, m, len); memcpy(buf, m, len);
sclk_source = sclk_source =
(struct avb_packet_aecp_aem_setget_clock_source *) p->payload; (struct avb_packet_aecp_aem_setget_clock_source *) p->payload;