mirror of
https://gitlab.freedesktop.org/pipewire/pipewire.git
synced 2026-04-29 06:46:38 -04:00
f3538dd7fe
Memory Safety: Critical When a Bluetooth BIS metadata entry has length=0 (e.g. when the JSON config contains a "type" key but no "value" key, leaving the calloc-initialized length at zero), the expression 'metadata_entry->length - 1' underflows to SIZE_MAX because the int value is implicitly converted to size_t in the memcpy call. This causes memcpy to read far past the metadata_entry->value buffer, leading to a heap buffer overflow and likely crash. Add a check that metadata_entry->length >= 1 before the subtraction, rejecting entries with invalid length. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| aec | ||
| alsa | ||
| audioconvert | ||
| audiomixer | ||
| audiotestsrc | ||
| avb | ||
| bluez5 | ||
| control | ||
| ffmpeg | ||
| filter-graph | ||
| jack | ||
| libcamera | ||
| support | ||
| test | ||
| v4l2 | ||
| videoconvert | ||
| videotestsrc | ||
| volume | ||
| vulkan | ||
| meson.build | ||