pipewire/spa
Wim Taymans 19213d5d48 audioconvert: avoid OOB mix matrix read
Patch by David Nowotny

In make_matrix (channelmix-ops.c), the matrix-filling loop at the done:
label allows the index i (and j in the inner loop) to grow beyond MAX_CHANNELS
when dst_paired/src_paired has sparse bits set. In that case the continue
fires for most values of i < CHANNEL_BITS, so i advances much faster than ic,
and matrix[i][j] reads off the end of the stack-allocated array.

Add bounds guards to both loop conditions so i and j cannot exceed
MAX_CHANNELS.

Fixes #5176
2026-03-17 14:16:10 +01:00
..
examples spa: examples: fix getopt usage + typos in adapter-control 2025-10-26 14:12:19 +00:00
include channelmix: add some more channelmix positions 2026-01-15 16:43:43 +01:00
include-private/spa-private spa: move dbus helpers out of bluez plugin 2024-02-05 13:03:20 +00:00
lib spa: add audio.layout property 2025-10-30 12:28:07 +01:00
plugins audioconvert: avoid OOB mix matrix read 2026-03-17 14:16:10 +01:00
tests tests: fix warning 2025-10-09 09:29:32 +02:00
tools meson.build: make spa-json-dump available for subprojects 2025-07-23 12:19:21 +00:00
meson.build meson: Always use -fno-strict-aliasing and -fno-strict-overflow 2025-07-24 07:30:28 +00:00