Commit graph

7922 commits

Author SHA1 Message Date
Wim Taymans
b5d294eab0 dfffile: handle invalid channels and rate
Missing or malformed headers could cause unspecified channels or rate
that can cause crashes.
2026-05-08 17:12:54 +02:00
Wim Taymans
57770c7e18 midifile: handle some other read errors 2026-05-08 17:07:51 +02:00
Wim Taymans
c94bbb55bc midifile: read up to 4 bytes for the varlen 2026-05-08 17:00:56 +02:00
Wim Taymans
4c8093fa72 combine-stream: clean up some variables
Move the source offs, stride, data and size calculations out of the
destination loop. We only need to clamp the size to copy to the maxsize
of the destination buffer.
2026-05-08 13:10:30 +02:00
Wim Taymans
93b940edef module-combine: limit size to buffer maxsize
Limit the amount of data we write to the destination buffer to its
maxsize.
2026-05-08 13:01:11 +02:00
Wim Taymans
6d3122c1b1 sap: avoid reading past the end of the string
parse_sdp_a_rtpmap used c += strlen(c) + 1 to skip past the MIME type to the
rate/channels part, but if the a=rtpmap: line had no / separator, strcspn
returned the full string length and the +1 advanced past the null terminator.

Fix this by checking if / was actually found, returning -EINVAL if not.
2026-05-08 11:57:07 +02:00
Wim Taymans
7fd3e13a3e netjack2: handle 0 in sync frames
JACK2 only sends -1 as the frames, meaning we should take the value from
the negotiated period as the frames to process.

We however send the actual number of frames and use the sync value to
decide how many frames to process. We need to be careful because a value
of 0 will cause a division by 0 so treat <= 0 frames the negotiated period
size as well.
2026-05-08 11:42:15 +02:00
Wim Taymans
753eae9302 netjack2: check config against MAX_CHANNELS
Check that the params don't include more than MAX_CHANNELS of audio or
else we overflow the position array.

Adapt to the compiled value of SPA_AUDIO_MAX_CHANNELS but allow at least
128 channels.
2026-05-08 11:07:03 +02:00
Wim Taymans
6cee86e509 sendspin: avoid buffer overread
Check that we have enough bytes (>=9) to parse the message type and the
timestamp.
2026-05-08 10:33:39 +02:00
Wim Taymans
22243d5ce9 sendspin: handle parse_player errors
Otherwise, this might leave the stride 0 and cause a division by 0
later.
2026-05-08 10:32:28 +02:00
Wim Taymans
5b37b9cf99 filter-graph: remove the pipe filter
It's a terrible idea, doesn't work so well (locks up the data-loop when
read is blocked) and a security mightmare. If you really need to pipe
samples through some program, do that somewhere else, like from the
command line with pw-cat and pw-record.
2026-05-08 10:16:12 +02:00
Wim Taymans
b3257ae425 context: add library.use-fallback option
Normally, when loading a plugin feature, often a library.name property
is given as well. If the feature to load is not explicitly listed in
context.spa-libs, the library.name is used a fallback library.

Add an option to ignore this library.name and only use the
context.spa-libs entries. This makes it possible to only load explicitly
listed features in the config file and makes it possible to lock down
what plugins can be loaded.

Set the option to true by default for now, which keeps the existing
behaviour of using the fallback library. Add some more entries to the
context.spa-libs in case the option is switched off to make things
work.

Set the option to false for the minimal.conf.
2026-05-08 09:57:52 +02:00
Wim Taymans
97c8a0a5ae modules: update docs for the pipe plugin 2026-05-07 14:46:21 +02:00
Wim Taymans
85decefbef filter-graph: move the pipe plugin to separate .so
It's quite dangerous to allow it to be loaded dynamically into the
pulse server so block it. The other plugins should be safe to load.
2026-05-07 14:37:44 +02:00
Wim Taymans
a4e2856d06 pulse-server: block arbitrary filter-graphs
Add a special 'blocked' spa-libs value that returns EPERM when trying to
load the factory.

Only allow loading the LADSPA filter.graph nodes for the LADSPA sink and
source. The most problematic part is the pipe filter, that allows it to
spawn arbirary programs as part of the filter.graph.

You can add a filter-graph to any stream with stream_props.
2026-05-07 14:13:38 +02:00
Wim Taymans
e3f75314be vban: fix timestamp overflows
Like how it is done in RTP.
2026-05-07 14:07:33 +02:00
Wim Taymans
e9aff3040a modules: free the stream and impl on errors 2026-05-07 13:30:12 +02:00
Wim Taymans
aa36fd5a17 pulse-server: avoid double free of props
Use spa_steal_ptr to transfer props ownership when we can.

This fixes a problem in the upload stream where the props would be freed
twice when buffer allocation failed, once with properties_free and
then with stream_free.
2026-05-07 10:30:35 +02:00
Wim Taymans
e975a44d05 modules: handle more stream setup failures
Instead of silently ignoring things.
2026-05-06 16:23:08 +02:00
Wim Taymans
9825fb3647 impl-link: use the right port direction string
We might swap input and output so make sure we use the right one in the
debug log to avoid confusion.
2026-05-06 16:21:07 +02:00
Wim Taymans
c362bca5e9 loopback: handle stream setup failure
Instead of silently failing.
Also when we do the cleanup, make sure we don't free the props twice.
2026-05-06 16:07:59 +02:00
Wim Taymans
95a4772031 modules: handle get_registry NULL return value 2026-05-06 13:50:02 +02:00
Wim Taymans
ac95f1241e modules: fix portal error handling
Mostly to fix the property cleanup.
2026-05-06 13:48:35 +02:00
Wim Taymans
51b635cc98 modules: convert snprintf to strbuf
Use spa_strbuf instead of snprintf to handle errors better.
2026-05-06 13:35:09 +02:00
Wim Taymans
2c4dc2d22f raop: handle loop_add_io errors 2026-05-06 13:18:11 +02:00
Wim Taymans
cc2c7cc591 modules: handle some property allocation errors 2026-05-06 13:17:41 +02:00
Wim Taymans
f5bbdc403f profiler: fix cleanup on errors
Make an impl_destroy function to clean up partially initialized impl.
Handle failed flush_event allocation. Handle all errors in one place.
2026-05-06 12:39:39 +02:00
Wim Taymans
aac0f13487 module-echo-cancel: fix cleanup
Go to the error label to make sure verything is cleaned up properly when
loading the aec plugin fails for some reason.
2026-05-06 12:27:09 +02:00
Wim Taymans
364436dd31 rtp-sap: handle out-of-bound SAP packet read
If the SAP packet contains the MIME type string but no SDP payload after it,
sdp would point past the null-terminated buffer. Check that we are
still inside the packet before parsing the SDP.
2026-05-06 11:57:52 +02:00
Wim Taymans
d32a21c4ee rtp-sap: handle uninitialized avail
When the ioctl fails, avail might be uninitialized. Check the ioctl
return value and handle invalid avail.
2026-05-06 11:57:52 +02:00
Wim Taymans
c4a2f9b480 rtp-sap: also handle short reads
Don't only handle -1 errors from read but also short reads that could
leave the buffer with uninitialized data.
2026-05-06 11:57:52 +02:00
Wim Taymans
ca46444d13 netjack2: limit period_size to quantum_limit
To avoid large periods that might not fit in the quantum.
2026-05-06 11:57:52 +02:00
Wim Taymans
aa29fefbd2 vban: limit the stream_name
The stream_name from the network is not 0 terminated so limit the
string to the max size.
2026-05-06 11:57:52 +02:00
Wim Taymans
8907d0860b modules: loop_add_io with close=true owns the fd
We should not close the fd when loop_add_io with close=true fails
because the fd is already closed.
2026-05-06 11:57:51 +02:00
Wim Taymans
620b18e9d8 zeroconf: check for NULL before doing strdup
Reject zeroconf entries without name, type, domain or host_name.
2026-05-05 18:17:42 +02:00
Wim Taymans
593b5cf148 protocol-simple: close client_fd when client alloc fails 2026-05-05 17:19:06 +02:00
Wim Taymans
b9761926df netjack2: go to the right error label
socket_failed is for when the socket fd failed, otherwise we need to do
cleanup.
2026-05-05 17:14:02 +02:00
Wim Taymans
c2bf8c920e protocol-native: close fd and unset env in all cases
If we find the fd valid, we must attempt to close it.
Also unset the env variable when we read and processed it, even if
there was an error.
2026-05-05 17:09:12 +02:00
Wim Taymans
aa6fa6bdc3 modules: make sure we don't deref potential NULL 2026-05-05 16:39:27 +02:00
Wim Taymans
9124a09482 modules: handle allocation error of properties 2026-05-05 16:34:15 +02:00
Wim Taymans
f8a76d9f00 protocol-native: handle allocation failures 2026-05-05 16:26:25 +02:00
Wim Taymans
01b2af13c7 pulse-server: handle strdup error 2026-05-05 14:54:43 +02:00
Wim Taymans
899051169e netjack2: handle property allocation failures 2026-05-05 14:51:43 +02:00
Wim Taymans
2ac7c81958 pipewire: handle allocation failures
And make sure we don't leak things in the error paths.
2026-05-05 14:44:39 +02:00
Wim Taymans
67e8da3390 modules: handle some allocation failures 2026-05-05 14:44:18 +02:00
Wim Taymans
3db8038652 modules: avoid useless props copy
We can use the properties we passed to the node.
2026-05-05 14:15:44 +02:00
Wim Taymans
9946f5ec77 modules: handle some more allocation errors 2026-05-05 14:14:52 +02:00
Wim Taymans
379b4a8747 introspect: handle strdup failures
Abort and clean up the dict copy when allocation fails.
2026-05-05 13:50:39 +02:00
Wim Taymans
dd695ee5a7 modules: handle allocation errors gracefully 2026-05-05 13:10:21 +02:00
Wim Taymans
96594d6716 plugins: handle some fd allocation errors 2026-05-05 11:36:45 +02:00