Previously, `module_x11_bell_data::module` was not initialized
properly, which led to a NULL pointer dereference in
`module_schedule_unload()` when called from `module_destroy()`
in case the native pipewire module was unloaded.
See #2392
When we move a message to the free list, reset the length to 0.
Otherwise the previous length plus the new length will be used to
allocated the message size, which would overallocate.
Previously, the resource listener was not removed when
the `node_data` object was freed, which could lead to
a use-after-free when the resource emitted an event
later.
==2787072==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000016728 at pc 0x7ffff7175b52 bp 0x7fffffffb930 sp 0x7fffffffb920
WRITE of size 8 at 0x61d000016728 thread T0
#0 0x7ffff7175b51 in spa_list_remove ../spa/include/spa/utils/list.h:77
#1 0x7ffff717cb5a in pw_resource_destroy ../src/pipewire/resource.c:335
#2 0x7ffff7051c56 in pw_global_destroy ../src/pipewire/global.c:417
#3 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130
#4 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784
#5 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352
#6 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423
#7 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427
#8 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409
#9 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148
#10 0x555555559722 in main ../src/daemon/pipewire.c:131
#11 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f)
#12 0x7ffff62a5349 in __libc_start_main (/usr/lib/libc.so.6+0x29349)
#13 0x5555555582a4 in _start (./src/daemon/pipewire+0x42a4)
0x61d000016728 is located 2216 bytes inside of 2264-byte region [0x61d000015e80,0x61d000016758)
freed by thread T0 here:
#0 0x7ffff798c672 in __interceptor_free /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x7ffff70f9bc3 in pw_impl_node_destroy ../src/pipewire/impl-node.c:1880
#2 0x7ffff70d1d57 in global_destroy ../src/pipewire/impl-node.c:638
#3 0x7ffff7051a4f in pw_global_destroy ../src/pipewire/global.c:414
#4 0x7ffff6f82a68 in registry_destroy ../src/pipewire/impl-core.c:130
#5 0x7ffff3a5f349 in registry_demarshal_destroy ../src/modules/module-protocol-native/protocol-native.c:784
#6 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352
#7 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423
#8 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427
#9 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409
#10 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148
#11 0x555555559722 in main ../src/daemon/pipewire.c:131
#12 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f)
previously allocated by thread T0 here:
#0 0x7ffff798d411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77
#1 0x7ffff70e5bb7 in pw_context_create_node ../src/pipewire/impl-node.c:1192
#2 0x7ffff28c748e in pw_spa_node_new ../src/modules/spa/spa-node.c:112
#3 0x7ffff28c9a9f in pw_spa_node_load ../src/modules/spa/spa-node.c:276
#4 0x7ffff28c1618 in create_object ../src/modules/spa/module-node-factory.c:134
#5 0x7ffff7106c4e in pw_impl_factory_create_object ../src/pipewire/impl-factory.c:273
#6 0x7ffff6f86dd7 in core_create_object ../src/pipewire/impl-core.c:349
#7 0x7ffff3a5cba9 in core_method_demarshal_create_object ../src/modules/module-protocol-native/protocol-native.c:680
#8 0x7ffff3a2c9ed in process_messages ../src/modules/module-protocol-native.c:352
#9 0x7ffff3a2e2ea in connection_data ../src/modules/module-protocol-native.c:423
#10 0x7ffff3e09402 in source_io_func ../spa/plugins/support/loop.c:427
#11 0x7ffff3e0851d in loop_iterate ../spa/plugins/support/loop.c:409
#12 0x7ffff709c21d in pw_main_loop_run ../src/pipewire/main-loop.c:148
#13 0x555555559722 in main ../src/daemon/pipewire.c:131
#14 0x7ffff62a528f (/usr/lib/libc.so.6+0x2928f)
SUMMARY: AddressSanitizer: heap-use-after-free ../spa/include/spa/utils/list.h:77 in spa_list_remove
Make MOVE_SINK_INPUT/MOVE_SOURCE_OUTPUT change the linked peer
immediately in subsequent GET_SINK_INPUT_INFO/GET_SOURCE_OUTPUT_INFO
commands. Do this by keeping track of the sink/source where the client
moved the stream to, and temporarily replying so in future GET_INFO (but
only in messages for that client).
We discard the temporary override when we either get an update event for
the stream (i.e. SM moved the stream), or a 1sec timer runs out. If the
timer runs out, we emit a sink-input/source-output change event, as in
that case what we claimed in the earlier GET_INFO messages might not be
true, so clients need to update their information.
This gets rid of race conditions where an application moves a stream,
and expects the move to be visible in future GET_INFO replies, which may
fail to happen because it takes some time for the session manager to
re-link the streams.
Fixes pasystray behavior.
Add functions for setting timer-based lifetimes for object data.
Having the timers in the object data themselves simplifies life cycle
management, as client/manager disconnects are handled without further
work.
Add the auth-anonymous option to module-native-protocol-tcp.
It does not exactly do what pulseaudio does but it will enable
unrestricted access instead.
Fixes#1899
This prevents the ringbuffer from advancing the read pointer more than
the size of data actually available. It prevents the "avail" value from
keeping to drop when no audio is being played by the client.
Applying this patch seems to prevent the "randomly playing music after
a couple hours of silence" issue
Fixes#2366
Make it possible to pass a spa_node as the follower of the adapter. This
avoids us having to wrap it in a pw_impl_node in order to unwrap it
again for the adapter spa_node.
When we set a control, don't emit the param_changed event. We will
already receive the control_info as a result of the change.
Reserve the param_changed event for things that got changed by
something else.
First collect all the graph objects and then parse them in the
right order. Otherwise, we might try to parse links before the nodes if
they are first in the JSON string.
Fixes#1950
When the client destroys the protocol-native module, the server
and the client are destroyed but the client is still reffed (not freed).
It will be unreffed after its messages are processed, after which point
it will be freed and removed from the server client_list that is already
destroyed.
Fix this by removing the client from the server list when it is
destroyed.
See #565
Guess the expected latency with the stream info we have and use that as
the node.latency. This way, the graph can attempt to start with some
sort of latency setting.
After we know the exact format, we can calculate the real latency and we
will update the node latency accordingly.
Add a refcount to resource and client so that we can keep them alive
while the native protocol is using them.
One problem might be that the protocol destroys the client or resource
while handling it and that would cause errors.
Fixes#565
When the global is destroyed, we remove our listeners and set the global
to NULL. We then destroy the module but because the global is NULL, we
don't remove ourselves from the list of modules, causing a crash later.
Fix this by always adding ourself to the list of modules and always
removing ourselves on destroy.
See #565
Use the new requested buffer field to only queue the amount of samples
required by the resampler for the current quantum. This avoid spikes
when the maxsize block of samples is processed.
Fixes#2353
Add some more context to the match rules and return how many properties
changed. If something changed, send all the properties as updates
instead of just the original changed ones.
