When we end up in a case where we are running 0 handles, such as when we
have a stereo filter but we want mono output, emit an error until we can
reasonably handle this case.
`client_update_quirks()` may modify `client::props` depending
on the "pulse.rules" section defined in the configuration file,
which means that it can change the value corresponding to the
"application.name" key. Therefore, `client::name` needs to
be queried after that.
`client::name` points to a string that is owned by `client::props`,
so when the property list is updated, it needs to be refreshed as well.
Otherwise, various use-after-frees can be triggered, for example:
==1471586==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200007e7d0 at pc 0x7f14390755d0 bp 0x7ffe23edee30 sp 0x7ffe23ede5a8
READ of size 3 at 0x60200007e7d0 thread T0
#0 0x7f14390755cf in printf_common /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors_format.inc:553
#1 0x7f1439077215 in __interceptor_vsnprintf /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1665
#2 0x7f1434ead47d in spa_vscnprintf ../spa/include/spa/utils/string.h:239
#3 0x7f1434eae2ae in impl_log_logtv ../spa/plugins/support/logger.c:138
#4 0x7f14385cacc7 in pw_log_logt ../src/pipewire/log.c:135
#5 0x7f1433aef8e9 in do_set_profile ../src/modules/module-protocol-pulse/pulse-server.c:4656
#6 0x7f1433b0af4d in handle_packet ../src/modules/module-protocol-pulse/server.c:109
#7 0x7f1433b0e747 in do_read ../src/modules/module-protocol-pulse/server.c:276
#8 0x7f1433b0eb04 in on_client_data ../src/modules/module-protocol-pulse/server.c:306
#9 0x7f1434ec56a0 in source_io_func ../spa/plugins/support/loop.c:442
#10 0x7f1434ec4a21 in loop_iterate ../spa/plugins/support/loop.c:430
#11 0x7f14385dc23d in pw_main_loop_run ../src/pipewire/main-loop.c:148
#12 0x55b065d73722 in main ../src/daemon/pipewire.c:131
#13 0x7f143742928f (/usr/lib/libc.so.6+0x2928f)
#14 0x7f1437429349 in __libc_start_main (/usr/lib/libc.so.6+0x29349)
#15 0x55b065d722a4 in _start (./src/daemon/pipewire-pulse+0x42a4)
0x60200007e7d0 is located 0 bytes inside of 16-byte region [0x60200007e7d0,0x60200007e7e0)
freed by thread T0 here:
#0 0x7f14390be672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x7f14386a775a in do_replace ../src/pipewire/properties.c:414
#2 0x7f14386a785e in pw_properties_set ../src/pipewire/properties.c:441
#3 0x7f14386a658b in pw_properties_update ../src/pipewire/properties.c:309
#4 0x7f1433adb055 in do_update_proplist ../src/modules/module-protocol-pulse/pulse-server.c:3246
#5 0x7f1433b0af4d in handle_packet ../src/modules/module-protocol-pulse/server.c:109
#6 0x7f1433b0e747 in do_read ../src/modules/module-protocol-pulse/server.c:276
#7 0x7f1433b0eb04 in on_client_data ../src/modules/module-protocol-pulse/server.c:306
#8 0x7f1434ec56a0 in source_io_func ../spa/plugins/support/loop.c:442
#9 0x7f1434ec4a21 in loop_iterate ../spa/plugins/support/loop.c:430
#10 0x7f14385dc23d in pw_main_loop_run ../src/pipewire/main-loop.c:148
#11 0x55b065d73722 in main ../src/daemon/pipewire.c:131
#12 0x7f143742928f (/usr/lib/libc.so.6+0x2928f)
previously allocated by thread T0 here:
#0 0x7f1439072faa in __interceptor_strdup /usr/src/debug/gcc/libsanitizer/asan/asan_interceptors.cpp:439
#1 0x7f14386a6fe2 in do_replace ../src/pipewire/properties.c:394
#2 0x7f14386a785e in pw_properties_set ../src/pipewire/properties.c:441
#3 0x7f1433a6c52d in read_props ../src/modules/module-protocol-pulse/message.c:147
#4 0x7f1433a6f467 in message_get ../src/modules/module-protocol-pulse/message.c:359
#5 0x7f1433ab3191 in do_set_client_name ../src/modules/module-protocol-pulse/pulse-server.c:1030
#6 0x7f1433b0af4d in handle_packet ../src/modules/module-protocol-pulse/server.c:109
#7 0x7f1433b0e747 in do_read ../src/modules/module-protocol-pulse/server.c:276
#8 0x7f1433b0eb04 in on_client_data ../src/modules/module-protocol-pulse/server.c:306
#9 0x7f1434ec56a0 in source_io_func ../spa/plugins/support/loop.c:442
#10 0x7f1434ec4a21 in loop_iterate ../spa/plugins/support/loop.c:430
#11 0x7f14385dc23d in pw_main_loop_run ../src/pipewire/main-loop.c:148
#12 0x55b065d73722 in main ../src/daemon/pipewire.c:131
#13 0x7f143742928f (/usr/lib/libc.so.6+0x2928f)
Add some 'before' debug info of the attributes.
First clamp the fragsize to the maxlength and then clamp to the
minfrag or else we could bypass the configured minfrag by setting a
lower maxlength.
Scale the maxlength to at least twice the fragsize so that we can
buffer enough data in the ringbuffer to serve fragsize bytes.
See #2447
As Coverity points out, `ensure_size()` is not fully correct.
Let us assume that the message already has some allocated storage,
and the `realloc()` call in the next `ensure_size()` invocation fails.
In that case `message::data` is freed, but the pointer is left behind.
If another `ensure_size()` call is made, then `realloc()` will be called
(since the previous call left `message::allocated` as zero), but the
first argument of the `realloc()` call will be a dangling pointer.
In order to avoid the above, first of all, clear `message::data` after
a failed `realloc()` call, and immediately return `-ENOMEM` if
`message::length` is greater than `message::allocated` since
that signals if the message has even run into an out-of-memory
situation.
Store a pointer to the owner `impl` object instead of
the (embedded) `stat` object. This way `message_free()`
can be simplified since the owner `impl` does not need
to be passed explicitly.
The `impl::servers` list contains all servers, and they are all
destroyed in `impl_clear()`. However, by that time, modules were
not freed previously, so if there were any instances of
*module-protocol-native-tcp* loaded, then the unload() method
of those would call `server_free()` on already freed servers,
resulting in use-after-frees. Fix that by unloading modules
before destroying the servers.
==451490==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000006050 ...
READ of size 8 at 0x612000006050 thread T0
#0 0x7f45edb19a0c in server_free ../src/modules/module-protocol-pulse/server.c:1022
#1 0x7f45edb46c7d in module_native_protocol_tcp_unload ../src/modules/module-protocol-pulse/modules/module-native-protocol-tcp.c:66
#2 0x7f45eda893c7 in module_unload ../src/modules/module-protocol-pulse/module.c:128
#3 0x7f45edaf7269 in impl_unload_module ../src/modules/module-protocol-pulse/pulse-server.c:5336
#4 0x7f45edaa1583 in pw_map_for_each ../src/pipewire/map.h:238
#5 0x7f45edaf79c5 in impl_clear ../src/modules/module-protocol-pulse/pulse-server.c:5358
...
0x612000006050 is located 16 bytes inside of 264-byte region [0x612000006040,0x612000006148)
freed by thread T0 here:
#0 0x7f45f30be672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x7f45edb1a48a in server_free ../src/modules/module-protocol-pulse/server.c:1040
#2 0x7f45edaf730b in impl_clear ../src/modules/module-protocol-pulse/pulse-server.c:5347
...
Fixes: f181210b29 ("pulse-server: properly unload modules")
As Coverity correctly points out, the `if (blocklist)` condition
is never true after the `out` label, so this commit makes some
changes to remove the dead code.
First of all, the `regex_t` object is directly embedded in the
module's data struct, so the `malloc()` call can be removed,
and thus there is no need for the cleanup code anymore, so everything
after the `out` label is also removed.
Furthermore, two NULL checks are removed which check `d->blocklist`
from `module_switch_on_connect_unload()` and `manager_added()`
because both of those functions can only ever run if the `d->blocklist`
regex object has been successfully initialized in `module_switch_on_connect_prepare()`.
Those checks were not strictly needed to begin with.
It is already logged by the module loading code when a module is
successfully loaded, so there is no need to print it on a per-module
basis at the same log level.
Check all pending streams to see if the new link completes their
creation.
It is possible that the link linked 2 pending streams and then we
want to complete them both.
All modules need to manually create a `module` object and check
if it was successfully created. The same with argument parsing.
To simplify modules, move the module object creation and argument
parsing into `module_create()`, and pass the already initialized
module to `module_info::create()`.
The semantics of `module_info::create()` are kept, that is,
if it fails, `module_info::unload()` will not be called.
Now that the module's properties are served from `module_info::properties`,
there is no need for modules to put their static properties into
the `module::props` dictionary.
Make sure to never send less than the negotiated fragsize to a client.
Also make sure we don't send too much data in one go. This is more in
line with what pulseaudio does.
Fixes capture from multiple tabs in chrome.
Fixes#2418
Previously, `module_x11_bell_data::module` was not initialized
properly, which led to a NULL pointer dereference in
`module_schedule_unload()` when called from `module_destroy()`
in case the native pipewire module was unloaded.
See #2392
