mirror of
https://gitlab.freedesktop.org/pipewire/pipewire.git
synced 2026-04-29 06:46:38 -04:00
d60ae4a1df
Memory Safety: High The add_stream_group() function computes a buffer size from the sum of multiple string lengths, including user-controlled dictionary values (media role, app name, etc.), and passes it to alloca() without any bounds check. A malicious client could send very long property strings causing an integer overflow in the size computation (wrapping a negative/small int) or an excessively large stack allocation, leading to a stack overflow. Add a bounds check to reject sizes that are negative or exceed 1024 bytes before calling alloca(). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| daemon | ||
| examples | ||
| gst | ||
| modules | ||
| pipewire | ||
| tests | ||
| tools | ||
| meson.build | ||