mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-12-16 08:56:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

SPA POD parser: Fix bug when parsing choice types

Browse source 
spa_pod_parser_can_collect and spa_pod_parser_getv were inconsistent
with each other.  When parsing crafted POD, this could cause a type
confusion or stack overflow.
This commit is contained in:
Demi Marie Obenour 2022-08-29 01:25:00 -04:00 • committed by Wim Taymans
parent 2e3347e850
commit fea248d450
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
spa/include/spa/pod/parser.h
View file

@ -285,10 +285,15 @@ static inline bool spa_pod_parser_can_collect(const struct spa_pod *pod, char ty
if (pod == NULL) if (pod == NULL)
return false; return false;
if (spa_pod_is_choice(pod) && if (SPA_POD_TYPE(pod) == SPA_TYPE_Choice) {
SPA_POD_CHOICE_TYPE(pod) == SPA_CHOICE_None && if (!spa_pod_is_choice(pod))
spa_pod_parser_can_collect(SPA_POD_CHOICE_CHILD(pod), type)) return false;
return true; if (type == 'V')
return true;
if (SPA_POD_CHOICE_TYPE(pod) != SPA_CHOICE_None)
return false;
pod = SPA_POD_CHOICE_CHILD(pod);
}
switch (type) { switch (type) {
case 'P': case 'P':
@ -328,7 +333,6 @@ static inline bool spa_pod_parser_can_collect(const struct spa_pod *pod, char ty
case 'O': case 'O':
return spa_pod_is_object(pod) || spa_pod_is_none(pod); return spa_pod_is_object(pod) || spa_pod_is_none(pod);
case 'V': case 'V':
return spa_pod_is_choice(pod);
default: default:
return false; return false;
} }
@ -493,8 +497,7 @@ static inline int spa_pod_parser_getv(struct spa_pod_parser *parser, va_list arg
} }
SPA_POD_PARSER_SKIP(*format, args); SPA_POD_PARSER_SKIP(*format, args);
} else { } else {
if (pod->type == SPA_TYPE_Choice && *format != 'V' && if (pod->type == SPA_TYPE_Choice && *format != 'V')
SPA_POD_CHOICE_TYPE(pod) == SPA_CHOICE_None)
pod = SPA_POD_CHOICE_CHILD(pod); pod = SPA_POD_CHOICE_CHILD(pod);
SPA_POD_PARSER_COLLECT(pod, *format, args); SPA_POD_PARSER_COLLECT(pod, *format, args);