Commit graph

7939 commits

Author SHA1 Message Date
Wim Taymans
4f975d0071 treewide: add error checking to spa_json_builder_close
There could have been a write error or allocation error while building
the json file that we can detect in spa_json_builder_close().

Error out instead of silently using a truncated JSON.

Use spa_autofree for the memory to make cleanup easier.
2026-05-13 18:14:44 +02:00
Wim Taymans
6d1c242433 pulse-server: implement more valid_args on modules
If the valid_args is NULL, reject all arguments.
2026-05-13 16:53:40 +02:00
Wim Taymans
5fa87d67a1 protocol-native: unref resource after logging the error 2026-05-13 11:12:17 +02:00
Wim Taymans
b53ec3bceb impl-metadata: check PW_PERM_M permission on subject
To set a metadata on a subject, the subject must be visible (R) and we
must have the M permission on the subject.
2026-05-13 11:08:37 +02:00
Wim Taymans
a74109eef3 settings: clamp the clock rate to avoid 0 division
Setting the rate to 0 could in some cases result in a division by zero,
avoid that by clamping to a min value.
2026-05-13 10:47:52 +02:00
Wim Taymans
e5ff44910e pulse-server: improve module argument checking
Make the module valid_args a structure that includes the argument key,
description and some flags. Use this to enforce mandatory properties
in a more central place.

We should be able to generate the module usage from this as wel later to
have things a bit more structured.
2026-05-13 10:23:47 +02:00
Wim Taymans
b54bac1862 modules: make and use pw_net_is_multicast 2026-05-12 13:02:21 +02:00
Wim Taymans
6d998a9193 modules: use pw_net_get_ip
Make pw_net_get_ip also accept NULL ip to just get the port and ip
version. Make rtsp-client use pw_net_get_ip.

Make sure we initialize the iovec before logging in all cases.
2026-05-12 12:52:03 +02:00
Wim Taymans
8860dc809d pulse-server: use pw_net_get_ip instead of inet_ntop 2026-05-12 12:14:52 +02:00
Wim Taymans
62846acb3f modules: use pw_net_get_ip 2026-05-12 09:29:19 +02:00
Wim Taymans
0c193b2b82 modules: invert memcmp logic
memcmp returns 0 when the memory is equal. This function is not used
currently.
2026-05-12 09:18:56 +02:00
Wim Taymans
9843ee858f modules: use sockaddr_storage for socket address
sockaddr_in only works for ipv4, for ipv6, the address will be truncated
and then cause a stack overread in inet_ntop.
2026-05-12 09:15:46 +02:00
Niklas Carlsson
a9d7023ec3 filter-graph: add min plugin
Output the lowest sample value of a number of inputs.
2026-05-11 15:39:40 +00:00
Wim Taymans
e286061df4 fix some compilation problems 2026-05-11 11:59:54 +02:00
Wim Taymans
3813f64a27 midifile: fix meta event read 2026-05-11 11:53:36 +02:00
Wim Taymans
b72f422f35 rtp: skip header extensions
When the header X bit is set, read the extension size and skip the
extension.
2026-05-11 09:25:31 +02:00
Wim Taymans
08d4e319cf avb: fix stack overflow in MRP parsing
AVB_MRP_VECTOR_GET_NUM_VALUES can be 13 bits and is stored in a
unit16_t. event_len and param_len are however calculated from this and
then truncated to 8 bits (uint8_t) which causes the bounds check to
silently pass and cause an OOB read.

Change the type to uint16_t to avoid overflows.
2026-05-08 18:13:12 +02:00
Wim Taymans
b5d294eab0 dfffile: handle invalid channels and rate
Missing or malformed headers could cause unspecified channels or rate
that can cause crashes.
2026-05-08 17:12:54 +02:00
Wim Taymans
57770c7e18 midifile: handle some other read errors 2026-05-08 17:07:51 +02:00
Wim Taymans
c94bbb55bc midifile: read up to 4 bytes for the varlen 2026-05-08 17:00:56 +02:00
Wim Taymans
4c8093fa72 combine-stream: clean up some variables
Move the source offs, stride, data and size calculations out of the
destination loop. We only need to clamp the size to copy to the maxsize
of the destination buffer.
2026-05-08 13:10:30 +02:00
Wim Taymans
93b940edef module-combine: limit size to buffer maxsize
Limit the amount of data we write to the destination buffer to its
maxsize.
2026-05-08 13:01:11 +02:00
Wim Taymans
6d3122c1b1 sap: avoid reading past the end of the string
parse_sdp_a_rtpmap used c += strlen(c) + 1 to skip past the MIME type to the
rate/channels part, but if the a=rtpmap: line had no / separator, strcspn
returned the full string length and the +1 advanced past the null terminator.

Fix this by checking if / was actually found, returning -EINVAL if not.
2026-05-08 11:57:07 +02:00
Wim Taymans
7fd3e13a3e netjack2: handle 0 in sync frames
JACK2 only sends -1 as the frames, meaning we should take the value from
the negotiated period as the frames to process.

We however send the actual number of frames and use the sync value to
decide how many frames to process. We need to be careful because a value
of 0 will cause a division by 0 so treat <= 0 frames the negotiated period
size as well.
2026-05-08 11:42:15 +02:00
Wim Taymans
753eae9302 netjack2: check config against MAX_CHANNELS
Check that the params don't include more than MAX_CHANNELS of audio or
else we overflow the position array.

Adapt to the compiled value of SPA_AUDIO_MAX_CHANNELS but allow at least
128 channels.
2026-05-08 11:07:03 +02:00
Wim Taymans
6cee86e509 sendspin: avoid buffer overread
Check that we have enough bytes (>=9) to parse the message type and the
timestamp.
2026-05-08 10:33:39 +02:00
Wim Taymans
22243d5ce9 sendspin: handle parse_player errors
Otherwise, this might leave the stride 0 and cause a division by 0
later.
2026-05-08 10:32:28 +02:00
Wim Taymans
5b37b9cf99 filter-graph: remove the pipe filter
It's a terrible idea, doesn't work so well (locks up the data-loop when
read is blocked) and a security mightmare. If you really need to pipe
samples through some program, do that somewhere else, like from the
command line with pw-cat and pw-record.
2026-05-08 10:16:12 +02:00
Wim Taymans
b3257ae425 context: add library.use-fallback option
Normally, when loading a plugin feature, often a library.name property
is given as well. If the feature to load is not explicitly listed in
context.spa-libs, the library.name is used a fallback library.

Add an option to ignore this library.name and only use the
context.spa-libs entries. This makes it possible to only load explicitly
listed features in the config file and makes it possible to lock down
what plugins can be loaded.

Set the option to true by default for now, which keeps the existing
behaviour of using the fallback library. Add some more entries to the
context.spa-libs in case the option is switched off to make things
work.

Set the option to false for the minimal.conf.
2026-05-08 09:57:52 +02:00
Wim Taymans
97c8a0a5ae modules: update docs for the pipe plugin 2026-05-07 14:46:21 +02:00
Wim Taymans
85decefbef filter-graph: move the pipe plugin to separate .so
It's quite dangerous to allow it to be loaded dynamically into the
pulse server so block it. The other plugins should be safe to load.
2026-05-07 14:37:44 +02:00
Wim Taymans
a4e2856d06 pulse-server: block arbitrary filter-graphs
Add a special 'blocked' spa-libs value that returns EPERM when trying to
load the factory.

Only allow loading the LADSPA filter.graph nodes for the LADSPA sink and
source. The most problematic part is the pipe filter, that allows it to
spawn arbirary programs as part of the filter.graph.

You can add a filter-graph to any stream with stream_props.
2026-05-07 14:13:38 +02:00
Wim Taymans
e3f75314be vban: fix timestamp overflows
Like how it is done in RTP.
2026-05-07 14:07:33 +02:00
Wim Taymans
e9aff3040a modules: free the stream and impl on errors 2026-05-07 13:30:12 +02:00
Wim Taymans
aa36fd5a17 pulse-server: avoid double free of props
Use spa_steal_ptr to transfer props ownership when we can.

This fixes a problem in the upload stream where the props would be freed
twice when buffer allocation failed, once with properties_free and
then with stream_free.
2026-05-07 10:30:35 +02:00
Wim Taymans
e975a44d05 modules: handle more stream setup failures
Instead of silently ignoring things.
2026-05-06 16:23:08 +02:00
Wim Taymans
9825fb3647 impl-link: use the right port direction string
We might swap input and output so make sure we use the right one in the
debug log to avoid confusion.
2026-05-06 16:21:07 +02:00
Wim Taymans
c362bca5e9 loopback: handle stream setup failure
Instead of silently failing.
Also when we do the cleanup, make sure we don't free the props twice.
2026-05-06 16:07:59 +02:00
Wim Taymans
95a4772031 modules: handle get_registry NULL return value 2026-05-06 13:50:02 +02:00
Wim Taymans
ac95f1241e modules: fix portal error handling
Mostly to fix the property cleanup.
2026-05-06 13:48:35 +02:00
Wim Taymans
51b635cc98 modules: convert snprintf to strbuf
Use spa_strbuf instead of snprintf to handle errors better.
2026-05-06 13:35:09 +02:00
Wim Taymans
2c4dc2d22f raop: handle loop_add_io errors 2026-05-06 13:18:11 +02:00
Wim Taymans
cc2c7cc591 modules: handle some property allocation errors 2026-05-06 13:17:41 +02:00
Wim Taymans
f5bbdc403f profiler: fix cleanup on errors
Make an impl_destroy function to clean up partially initialized impl.
Handle failed flush_event allocation. Handle all errors in one place.
2026-05-06 12:39:39 +02:00
Wim Taymans
aac0f13487 module-echo-cancel: fix cleanup
Go to the error label to make sure verything is cleaned up properly when
loading the aec plugin fails for some reason.
2026-05-06 12:27:09 +02:00
Wim Taymans
364436dd31 rtp-sap: handle out-of-bound SAP packet read
If the SAP packet contains the MIME type string but no SDP payload after it,
sdp would point past the null-terminated buffer. Check that we are
still inside the packet before parsing the SDP.
2026-05-06 11:57:52 +02:00
Wim Taymans
d32a21c4ee rtp-sap: handle uninitialized avail
When the ioctl fails, avail might be uninitialized. Check the ioctl
return value and handle invalid avail.
2026-05-06 11:57:52 +02:00
Wim Taymans
c4a2f9b480 rtp-sap: also handle short reads
Don't only handle -1 errors from read but also short reads that could
leave the buffer with uninitialized data.
2026-05-06 11:57:52 +02:00
Wim Taymans
ca46444d13 netjack2: limit period_size to quantum_limit
To avoid large periods that might not fit in the quantum.
2026-05-06 11:57:52 +02:00
Wim Taymans
aa29fefbd2 vban: limit the stream_name
The stream_name from the network is not 0 terminated so limit the
string to the max size.
2026-05-06 11:57:52 +02:00