pipewire/spa/plugins
Wim Taymans 4de0f83aca security: add missing NULL checks after realloc/strdup in LV2 plugin
Memory Safety: Medium

Two issues in the LV2 filter-graph plugin:

1. uri_table_map(): realloc() result was assigned directly to
   table->data, losing the original pointer on failure (memory leak)
   and causing a NULL pointer dereference on the next access. Also
   the subsequent strdup() had no NULL check. Fixed by using a
   temporary pointer for realloc and checking strdup's return.

2. lv2_state_retrieve(): realloc() of sd->tmp was used without a
   NULL check, so a failed allocation would cause sd->tmp to become
   NULL and be immediately passed to spa_json_parse_stringn(). Fixed
   by checking the realloc result before assignment.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-29 11:35:08 +02:00
..
aec spa: aec: Add some channel config validation 2026-03-17 12:06:25 +00:00
alsa security: add missing O_CLOEXEC/SOCK_CLOEXEC flags 2026-04-28 12:20:33 +02:00
audioconvert channelmix: add SEE 7p1 to stereo downmix 2026-04-27 15:59:38 +02:00
audiomixer audiomixer: rate limit the "out of buffers" debug 2026-04-28 10:34:39 +02:00
audiotestsrc spa: do not use SPA_PROP_live 2026-03-27 18:03:24 +01:00
avb security: fix missing NULL check and integer overflow in AVB ringbuffer 2026-04-28 13:05:09 +02:00
bluez5 security: add missing NULL checks after strdup in modemmanager 2026-04-29 11:34:37 +02:00
control mixer: handle control.ump property 2026-03-25 11:59:43 +01:00
ffmpeg
filter-graph security: add missing NULL checks after realloc/strdup in LV2 plugin 2026-04-29 11:35:08 +02:00
jack *: don't include standard C headers inside of extern "C" 2025-05-30 09:48:28 +01:00
libcamera spa: libcamera: use std::span 2026-03-27 09:57:56 +01:00
support security: add missing O_CLOEXEC/SOCK_CLOEXEC flags 2026-04-28 12:20:33 +02:00
test spa: do not use SPA_PROP_live 2026-03-27 18:03:24 +01:00
v4l2 security: add missing O_CLOEXEC flag to V4L2 device open 2026-04-28 12:56:40 +02:00
videoconvert overflow: fix some more potential overflows 2026-04-27 12:29:31 +02:00
videotestsrc spa: do not use SPA_PROP_live 2026-03-27 18:03:24 +01:00
volume treewide: access the position information using helpers 2025-10-21 13:06:25 +02:00
vulkan vulkan: fix wrong descriptor image info index 2026-04-21 15:13:03 +00:00
meson.build spa/plugins: revert "Disable alsa plugin on !Linux platforms." 2026-03-12 09:20:05 +00:00