mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-19 06:46:26 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

*: Missing bounds checks in POD handling

Browse source 
There were missing bounds checks for ill-formed POD all over the place.
This commit is contained in:
Demi Marie Obenour 2025-06-06 14:48:33 -04:00 • committed by Wim Taymans
parent 7ac94f1a69
commit fb315b9050
7 changed files with 104 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

22
spa/include/spa/debug/format.h
View file

@ -39,10 +39,14 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
switch (type) {
case SPA_TYPE_Bool:
if (size < sizeof(int32_t))
goto bad_body;
spa_strbuf_append(buffer, "%s", *(int32_t *) body ? "true" : "false");
break;
case SPA_TYPE_Id:
{
if (size < sizeof(uint32_t))
goto bad_body;
uint32_t value = *(uint32_t *) body;
const char *str = spa_debug_type_find_short_name(info, value);
char tmp[64];
@ -54,28 +58,42 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
break;
}
case SPA_TYPE_Int:
if (size < sizeof(int32_t))
goto bad_body;
spa_strbuf_append(buffer, "%d", *(int32_t *) body);
break;
case SPA_TYPE_Long:
if (size < sizeof(int64_t))
goto bad_body;
spa_strbuf_append(buffer, "%" PRIi64, *(int64_t *) body);
break;
case SPA_TYPE_Float:
if (size < sizeof(float))
goto bad_body;
spa_strbuf_append(buffer, "%f", *(float *) body);
break;
case SPA_TYPE_Double:
if (size < sizeof(double))
goto bad_body;
spa_strbuf_append(buffer, "%f", *(double *) body);
break;
case SPA_TYPE_String:
if (size < 1 || ((const char *)body)[size - 1] != '\0')
goto bad_body;
spa_strbuf_append(buffer, "%s", (char *) body);
break;
case SPA_TYPE_Rectangle:
{
if (size < sizeof(struct spa_rectangle))
goto bad_body;
struct spa_rectangle *r = (struct spa_rectangle *)body;
spa_strbuf_append(buffer, "%" PRIu32 "x%" PRIu32, r->width, r->height);
break;
}
case SPA_TYPE_Fraction:
{
if (size < sizeof(struct spa_fraction))
goto bad_body;
struct spa_fraction *f = (struct spa_fraction *)body;
spa_strbuf_append(buffer, "%" PRIu32 "/%" PRIu32, f->num, f->denom);
break;
@ -91,6 +109,8 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
void *p;
struct spa_pod_array_body *b = (struct spa_pod_array_body *)body;
int i = 0;
if (size < sizeof(*b))
goto bad_body;
info = info && info->values ? info->values : info;
spa_strbuf_append(buffer, "< ");
SPA_POD_ARRAY_BODY_FOREACH(b, size, p) {
@ -105,6 +125,8 @@ spa_debug_strbuf_format_value(struct spa_strbuf *buffer, const struct spa_type_i
spa_strbuf_append(buffer, "INVALID type %d", type);
break;
}
bad_body:
spa_strbuf_append(buffer, "INVALID BODY type %d", type);
return 0;
}