mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-30 06:46:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
pipewire/src/modules/module-avb
History
Wim Taymans e01ca8919e security: fix integer underflow in AVB stream packet handling 
Memory Safety: Critical

In handle_iec61883_packet(), the data_len field from an incoming network
packet is converted via ntohs() and then unconditionally has 8 subtracted
from it. If an attacker sends a malformed AVB packet with data_len < 8,
the subtraction wraps the uint32_t n_bytes to a very large value
(~4 billion). This corrupted size is then passed to
spa_ringbuffer_write_data(), which can overwrite the ring buffer and
adjacent heap memory with attacker-controlled network data.

Add a bounds check to verify data_len >= 8 before the subtraction,
returning early on malformed packets.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-24 15:55:35 +02:00
..
aecp-aem-cmds-resps module-avb: fix GET_NAME to validate length before field reads and reply with fixed size 2026-04-24 11:50:23 +02:00
aaf.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
acmp.c module-avb: fix ACMP error responses sent with wrong message type 2026-04-09 07:43:19 +00:00
acmp.h pipewire: module-avb: add some missing declarations 2023-07-03 19:40:31 +02:00
adp.c module-avb: adp: clean the allocated resources if any 2025-12-01 09:08:26 +00:00
adp.h pipewire: module-avb: add some missing declarations 2023-07-03 19:40:31 +02:00
aecp-aem-control-value-units.h milan-avb: introducing aem control value units header 2026-01-11 10:26:10 +00:00
aecp-aem-controls.h module-avb: descriptors: adding control specific defines 2025-12-07 16:07:56 +00:00
aecp-aem-descriptors.h milan-avb: using pull and frequency as a union 2026-01-09 13:04:19 +00:00
aecp-aem-milan.h module-avb: aecp-aem: add Milan specific aecp aem into its own header 2025-12-01 09:16:06 +00:00
aecp-aem-state.h module-avb: milan: make lock state as part of the generic entity state structure 2025-12-07 16:08:36 +00:00
aecp-aem-types.h module-avb: aecp-aem: move type into their own dedicated header file 2025-12-07 16:07:56 +00:00
aecp-aem.c module-avb: bound descriptor size in READ_DESCRIPTOR reply to prevent stack overflow 2026-04-22 19:19:10 +02:00
aecp-aem.h milan-avb: lock: make it lockable: 2026-04-16 12:42:23 +02:00
aecp.c module-avb: enforce minimum AECP packet length and replace VLA on dispatch 2026-04-23 17:25:26 +02:00
aecp.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
avb-transport-loopback.h module-avb: extend transport abstraction to stream data path 2026-04-09 07:43:19 +00:00
avb.c modules: port modules to timer-queue 2025-10-15 16:57:24 +02:00
avb.h pipewire: module-avb: add missing "stddef.h" include in "avb.h" 2023-07-03 19:40:31 +02:00
avdecc.c module-avb: extend transport abstraction to stream data path 2026-04-09 07:43:19 +00:00
descriptors.c modules-avb: legacy-avb: entity warnings 2026-04-19 08:15:55 +02:00
descriptors.h module-avb: milan: introducing full entity model for mlian v1.2 2025-12-15 08:17:50 +00:00
entity-model-milan-v12.h module-avb: milan: introducing full entity model for mlian v1.2 2025-12-15 08:17:50 +00:00
es-builder.c module-avb: es_builder: use the descriptor rather than a pointer to avoid overwriting it 2026-04-20 10:10:58 +02:00
es-builder.h modules-avb: Introducing entity builder. The entity builder is necessary 2025-11-21 08:26:15 +00:00
iec61883.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
internal.h module-avb: extend transport abstraction to stream data path 2026-04-09 07:43:19 +00:00
maap.c spa: add spa_json_object_next 2024-09-16 09:50:36 +02:00
maap.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
mmrp.c treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
mmrp.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
mrp.c module-avb: fix MRP NEW messages never being transmitted 2026-04-09 07:43:19 +00:00
mrp.h module-avb: fix MRP NEW messages never being transmitted 2026-04-09 07:43:19 +00:00
msrp.c module-avb: fix MRP NEW messages never being transmitted 2026-04-09 07:43:19 +00:00
msrp.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
mvrp.c module-avb: fix MRP NEW messages never being transmitted 2026-04-09 07:43:19 +00:00
mvrp.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
packets.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
srp.c treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
srp.h treewide: use SPDX tags to specify copyright information 2023-02-16 10:54:48 +00:00
stream.c security: fix integer underflow in AVB stream packet handling 2026-04-24 15:55:35 +02:00
stream.h module-avb: extend transport abstraction to stream data path 2026-04-09 07:43:19 +00:00
utils.h module-avb: utils: introduce array size for static arrays 2025-12-01 09:16:06 +00:00