pipewire/src/modules/module-vban
Wim Taymans d4ec630b2f security: fix missing packet length validation in VBAN MIDI receive
Memory Safety: High

In vban_midi_receive(), the received buffer is cast to struct
vban_header and its n_frames field is accessed before validating
that the packet is large enough to contain the header. A truncated
packet shorter than VBAN_HEADER_SIZE would cause an out-of-bounds
read.

Fix by checking that len >= VBAN_HEADER_SIZE before accessing the
header, matching the fix applied to vban_audio_receive().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-24 15:55:35 +02:00
..
audio.c security: fix missing packet length validation in VBAN audio receive 2026-04-24 15:55:35 +02:00
midi.c security: fix missing packet length validation in VBAN MIDI receive 2026-04-24 15:55:35 +02:00
stream.c module-vban: derive write position from frame counter 2026-02-27 22:48:12 -08:00
stream.h modules-vban: add vban sender and receiver 2023-07-25 18:36:48 +02:00
vban.h pipewire: module-vban: fix vban serial header 2024-12-14 23:09:45 +01:00