mirror of
https://gitlab.freedesktop.org/pipewire/pipewire.git
synced 2026-05-13 23:50:29 -04:00
At the moment, file descriptors may be leaked due to a malicious/buggy client: 1. If the control messages have been truncated, some file descriptors may still have been successfully transferred. Currently, seeing the MSG_CTRUNC bit causes `refill_buffer()` to immediately return -EPROTO without doing anything with the control messages, which may contain file descriptors. 2. When there is no truncation, it is still possible that the current batch of file descriptors causes the total file descriptor count to go over the maximum number of fds for the given buffer (currently 1024). In this case, too, `refill_buffer()` immediately returns -EPROTO without closing the file descriptors that can not be saved. Fix both of these cases by closing all file descriptors in all remaining cmsgs when one of the mentioned conditions occur. |
||
|---|---|---|
| .. | ||
| module-adapter | ||
| module-client-device | ||
| module-client-node | ||
| module-echo-cancel | ||
| module-filter-chain | ||
| module-metadata | ||
| module-profiler | ||
| module-protocol-native | ||
| module-protocol-pulse | ||
| module-raop | ||
| module-session-manager | ||
| module-zeroconf-discover | ||
| spa | ||
| meson.build | ||
| module-access.c | ||
| module-adapter.c | ||
| module-client-device.c | ||
| module-client-node.c | ||
| module-echo-cancel.c | ||
| module-example-sink.c | ||
| module-example-source.c | ||
| module-filter-chain.c | ||
| module-link-factory.c | ||
| module-loopback.c | ||
| module-metadata.c | ||
| module-portal.c | ||
| module-profiler.c | ||
| module-protocol-native.c | ||
| module-protocol-pulse.c | ||
| module-protocol-simple.c | ||
| module-pulse-tunnel.c | ||
| module-raop-discover.c | ||
| module-raop-sink.c | ||
| module-roc-sink.c | ||
| module-roc-source.c | ||
| module-rt.c | ||
| module-session-manager.c | ||
| module-zeroconf-discover.c | ||