mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-10-31 22:25:38 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

spa: use safe IO_Control parsing

Browse source 
The IO_Control areas are in shaed memory and need to use the parser to
safely extract the info.
This commit is contained in:
Wim Taymans 2025-07-31 11:23:30 +02:00
parent ede1924ded
commit f4ab704948
4 changed files with 75 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

35
spa/plugins/v4l2/v4l2-source.c
View file

@ -113,6 +113,7 @@ struct port {
struct spa_port_info info;
struct spa_io_buffers *io;
struct spa_io_sequence *control;
uint32_t control_size;
#define PORT_PropInfo 0
#define PORT_EnumFormat 1
#define PORT_Meta 2
@ -403,7 +404,7 @@ static int impl_node_set_param(void *object,
sizeof(p->device)-1);
break;
default:
spa_v4l2_set_control(this, prop->key, prop);
spa_v4l2_set_control(this, prop, SPA_POD_BODY_CONST(&prop->value));
break;
}
}
@ -863,6 +864,7 @@ static int impl_node_port_set_io(void *object,
break;
case SPA_IO_Control:
port->control = data;
port->control_size = size;
break;
default:
return -ENOENT;
@ -890,20 +892,31 @@ static int impl_node_port_reuse_buffer(void *object,
return res;
}
static int process_control(struct impl *this, struct spa_pod_sequence *control)
static int process_control(struct impl *this, struct spa_pod_sequence *control, uint32_t size)
{
struct spa_pod_control *c;
struct spa_pod_parser parser[2];
struct spa_pod_frame frame[2];
struct spa_pod_sequence seq;
const void *seq_body, *c_body;
struct spa_pod_control c;
SPA_POD_SEQUENCE_FOREACH(control, c) {
switch (c->type) {
spa_pod_parser_init_from_data(&parser[0], control, size, 0, size);
if (spa_pod_parser_push_sequence_body(&parser[0], &frame[0], &seq, &seq_body) < 0)
return 0;
while (spa_pod_parser_get_control_body(&parser[0], &c, &c_body) >= 0) {
switch (c.type) {
case SPA_CONTROL_Properties:
{
struct spa_pod_prop *prop;
struct spa_pod_object *obj = (struct spa_pod_object *) &c->value;
struct spa_pod_object obj;
struct spa_pod_prop prop;
const void *obj_body, *prop_body;
SPA_POD_OBJECT_FOREACH(obj, prop) {
spa_v4l2_set_control(this, prop->key, prop);
}
if (spa_pod_parser_init_object_body(&parser[1], &frame[1],
&c.value, c_body, &obj, &obj_body) < 0)
continue;
while (spa_pod_parser_get_prop_body(&parser[1], &prop, &prop_body) >= 0)
spa_v4l2_set_control(this, &prop, prop_body);
break;
}
default:
@ -928,7 +941,7 @@ static int impl_node_process(void *object)
return -EIO;
if (port->control)
process_control(this, &port->control->sequence);
process_control(this, &port->control->sequence, port->control_size);
spa_log_trace(this->log, "%p; status %d", this, io->status);

3
spa/plugins/v4l2/v4l2-utils.c
View file

@ -1569,8 +1569,7 @@ done:
}
static int
spa_v4l2_set_control(struct impl *this, uint32_t id,
const struct spa_pod_prop *prop)
spa_v4l2_set_control(struct impl *this, const struct spa_pod_prop *prop, const void *body)
{
struct port *port = &this->out_ports[0];
struct spa_v4l2_device *dev = &port->dev;