pipewire/spa/plugins/avb
Wim Taymans 1de8615caf security: fix missing NULL check and integer overflow in AVB ringbuffer
Memory Safety: Medium

The AVB PCM ringbuffer allocation used calloc(1, size * 4) which has
two issues: the multiplication can overflow for large ringbuffer_size
values (derived from quantum_limit config parameter), and the return
value was never checked for NULL.

Fixed by using calloc(size, 4) which lets calloc check for overflow
internally, and added a NULL check for the allocation result.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-28 13:05:09 +02:00
..
avbtp treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
avb-pcm-sink.c spa: small cleanups 2024-01-10 15:51:01 +01:00
avb-pcm-source.c spa: small cleanups 2024-01-10 15:51:01 +01:00
avb-pcm.c security: fix missing NULL check and integer overflow in AVB ringbuffer 2026-04-28 13:05:09 +02:00
avb-pcm.h Don't use SPA_AUDIO_MAX_CHANNELS directly 2025-10-21 09:43:06 +02:00
avb.c spa: export log topic enumerations 2024-01-04 10:02:55 +00:00
avb.h spa: remove unnecessary indirection for some spa_log_topics 2023-10-06 13:08:24 +00:00
meson.build avb: remove wrong cargs 2022-07-13 13:14:07 +02:00