mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-28 06:46:42 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

module-avb: enforce minimum AECP packet length and replace VLA on dispatch

Browse source
This commit is contained in:
hackerman-kl 2026-04-23 17:25:26 +02:00
parent 6ca2f509e3
commit f091b85b03
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/modules/module-avb/aecp.c
View file

@ -2,6 +2,8 @@
/* SPDX-FileCopyrightText: Copyright © 2022 Wim Taymans */ /* SPDX-FileCopyrightText: Copyright © 2022 Wim Taymans */
/* SPDX-License-Identifier: MIT */ /* SPDX-License-Identifier: MIT */
#include <errno.h>
#include <spa/utils/json.h> #include <spa/utils/json.h>
#include <spa/debug/mem.h> #include <spa/debug/mem.h>
@ -22,10 +24,13 @@ struct msg_info {
static int reply_not_implemented(struct aecp *aecp, const void *p, int len) static int reply_not_implemented(struct aecp *aecp, const void *p, int len)
{ {
struct server *server = aecp->server; struct server *server = aecp->server;
uint8_t buf[len]; uint8_t buf[AVB_PACKET_MILAN_DEFAULT_MTU];
struct avb_ethernet_header *h = (void*)buf; struct avb_ethernet_header *h = (void*)buf;
struct avb_packet_aecp_header *reply = SPA_PTROFF(h, sizeof(*h), void); struct avb_packet_aecp_header *reply = SPA_PTROFF(h, sizeof(*h), void);
if (len < 0 || (size_t)len > sizeof(buf))
return -EINVAL;
memcpy(h, p, len); memcpy(h, p, len);
AVB_PACKET_AECP_SET_STATUS(reply, AVB_AECP_STATUS_NOT_IMPLEMENTED); AVB_PACKET_AECP_SET_STATUS(reply, AVB_AECP_STATUS_NOT_IMPLEMENTED);
@ -64,6 +69,10 @@ static int aecp_message(void *data, uint64_t now, const void *message, int len)
const struct msg_info *info; const struct msg_info *info;
int message_type; int message_type;
if (len < 0 ||
(size_t)len < sizeof(*h) + sizeof(*p) ||
(size_t)len > AVB_PACKET_MILAN_DEFAULT_MTU)
return 0;
if (ntohs(h->type) != AVB_TSN_ETH) if (ntohs(h->type) != AVB_TSN_ETH)
return 0; return 0;
if (memcmp(h->dest, mac, 6) != 0 && if (memcmp(h->dest, mac, 6) != 0 &&