mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-11-01 22:58:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

*: Missing bounds checks in POD handling

Browse source 
There were missing bounds checks for ill-formed POD all over the place.
This commit is contained in:
Demi Marie Obenour 2025-06-06 14:48:33 -04:00 • committed by Wim Taymans
parent 7ac94f1a69
commit fb315b9050
7 changed files with 104 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

22
spa/include/spa/debug/format.h
View file

@ -39,10 +39,14 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
switch (type) {
case SPA_TYPE_Bool:
if (size < sizeof(int32_t))
goto bad_body;
spa_strbuf_append(buffer, "%s", *(int32_t *) body ? "true" : "false");
break;
case SPA_TYPE_Id:
{
if (size < sizeof(uint32_t))
goto bad_body;
uint32_t value = *(uint32_t *) body;
const char *str = spa_debug_type_find_short_name(info, value);
char tmp[64];
@ -54,28 +58,42 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
break;
}
case SPA_TYPE_Int:
if (size < sizeof(int32_t))
goto bad_body;
spa_strbuf_append(buffer, "%d", *(int32_t *) body);
break;
case SPA_TYPE_Long:
if (size < sizeof(int64_t))
goto bad_body;
spa_strbuf_append(buffer, "%" PRIi64, *(int64_t *) body);
break;
case SPA_TYPE_Float:
if (size < sizeof(float))
goto bad_body;
spa_strbuf_append(buffer, "%f", *(float *) body);
break;
case SPA_TYPE_Double:
if (size < sizeof(double))
goto bad_body;
spa_strbuf_append(buffer, "%f", *(double *) body);
break;
case SPA_TYPE_String:
if (size < 1 || ((const char *)body)[size - 1] != '\0')
goto bad_body;
spa_strbuf_append(buffer, "%s", (char *) body);
break;
case SPA_TYPE_Rectangle:
{
if (size < sizeof(struct spa_rectangle))
goto bad_body;
struct spa_rectangle *r = (struct spa_rectangle *)body;
spa_strbuf_append(buffer, "%" PRIu32 "x%" PRIu32, r->width, r->height);
break;
}
case SPA_TYPE_Fraction:
{
if (size < sizeof(struct spa_fraction))
goto bad_body;
struct spa_fraction *f = (struct spa_fraction *)body;
spa_strbuf_append(buffer, "%" PRIu32 "/%" PRIu32, f->num, f->denom);
break;
@ -91,6 +109,8 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
void *p;
struct spa_pod_array_body *b = (struct spa_pod_array_body *)body;
int i = 0;
if (size < sizeof(*b))
goto bad_body;
info = info && info->values ? info->values : info;
spa_strbuf_append(buffer, "< ");
SPA_POD_ARRAY_BODY_FOREACH(b, size, p) {
@ -105,6 +125,8 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
spa_strbuf_append(buffer, "INVALID type %d", type);
break;
}
bad_body:
spa_strbuf_append(buffer, "INVALID BODY type %d", type);
return 0;
}

12
spa/include/spa/pod/compare.h
View file

@ -186,8 +186,12 @@ SPA_API_POD_COMPARE int spa_pod_compare_is_compatible_flags(uint32_t type, const
{
switch (type) {
case SPA_TYPE_Int:
if (size < sizeof(int32_t))
return -EINVAL;
return ((*(int32_t *) r1) & (*(int32_t *) r2)) != 0;
case SPA_TYPE_Long:
if (size < sizeof(int64_t))
return -EINVAL;
return ((*(int64_t *) r1) & (*(int64_t *) r2)) != 0;
default:
return -ENOTSUP;
@ -197,18 +201,24 @@ SPA_API_POD_COMPARE int spa_pod_compare_is_compatible_flags(uint32_t type, const
SPA_API_POD_COMPARE int spa_pod_compare_is_step_of(uint32_t type, const void *r1,
const void *r2, uint32_t size SPA_UNUSED)
const void *r2, uint32_t size)
{
switch (type) {
case SPA_TYPE_Int:
if (size < sizeof(int32_t))
return -EINVAL;
return *(int32_t *) r1 % *(int32_t *) r2 == 0;
case SPA_TYPE_Long:
if (size < sizeof(int64_t))
return -EINVAL;
return *(int64_t *) r1 % *(int64_t *) r2 == 0;
case SPA_TYPE_Rectangle:
{
const struct spa_rectangle *rec1 = (struct spa_rectangle *) r1,
*rec2 = (struct spa_rectangle *) r2;
if (size < sizeof(struct spa_rectangle))
return -EINVAL;
return (rec1->width % rec2->width == 0 &&
rec1->height % rec2->height == 0);
}

5
spa/include/spa/pod/simplify.h
View file

@ -43,9 +43,8 @@ spa_pod_simplify_merge(struct spa_pod_builder *b, const struct spa_pod *pod1, co
struct spa_pod_frame f[2];
int res = 0, count = 0;
if (pod1->type != pod2->type)
return -ENOTSUP;
if (pod1->type != SPA_TYPE_Object)
if (!spa_pod_is_object(pod1) ||
!spa_pod_is_object(pod2))
return -ENOTSUP;
o1 = (const struct spa_pod_object*) pod1;