mirrors/pulseaudio
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pulseaudio/pulseaudio.git synced 2025-11-03 09:01:50 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

sink-input/source-output: Prevent filter sink/source cycles

Browse source 
Misbehaving clients can try to set a filter sink to output to
itself, leading to crashes later on. This patch protects us from that.

Thanks to Roman Beslik for testing and finding an error in the first
version of this patch.

Tested-by: Roman Beslik <rabeslik@gmail.com>
BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=44397
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
This commit is contained in:
David Henningsson 2012-03-23 13:06:27 +01:00
parent 3116547662
commit b7fab75fdd
2 changed files with 34 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/pulsecore/sink-input.c
View file

@ -1383,6 +1383,17 @@ pa_bool_t pa_sink_input_may_move(pa_sink_input *i) {
return TRUE;
}
static pa_bool_t find_filter_sink_input(pa_sink_input *target, pa_sink *s) {
int i = 0;
while (s && s->input_to_master) {
if (s->input_to_master == target)
return TRUE;
s = s->input_to_master->sink;
pa_assert(i++ < 100);
}
return FALSE;
}
/* Called from main context */
pa_bool_t pa_sink_input_may_move_to(pa_sink_input *i, pa_sink *dest) {
pa_sink_input_assert_ref(i);
@ -1396,6 +1407,12 @@ pa_bool_t pa_sink_input_may_move_to(pa_sink_input *i, pa_sink *dest) {
if (!pa_sink_input_may_move(i))
return FALSE;
/* Make sure we're not creating a filter sink cycle */
if (find_filter_sink_input(i, dest)) {
pa_log_debug("Can't connect input to %s, as that would create a cycle.", dest->name);
return FALSE;
}
if (pa_idxset_size(dest->inputs) >= PA_MAX_INPUTS_PER_SINK) {
pa_log_warn("Failed to move sink input: too many inputs per sink.");
return FALSE;

17
src/pulsecore/source-output.c
View file

@ -1160,6 +1160,17 @@ pa_bool_t pa_source_output_may_move(pa_source_output *o) {
return TRUE;
}
static pa_bool_t find_filter_source_output(pa_source_output *target, pa_source *s) {
int i = 0;
while (s && s->output_from_master) {
if (s->output_from_master == target)
return TRUE;
s = s->output_from_master->source;
pa_assert(i++ < 100);
}
return FALSE;
}
/* Called from main context */
pa_bool_t pa_source_output_may_move_to(pa_source_output *o, pa_source *dest) {
pa_source_output_assert_ref(o);
@ -1172,6 +1183,12 @@ pa_bool_t pa_source_output_may_move_to(pa_source_output *o, pa_source *dest) {
if (!pa_source_output_may_move(o))
return FALSE;
/* Make sure we're not creating a filter source cycle */
if (find_filter_source_output(o, dest)) {
pa_log_debug("Can't connect output to %s, as that would create a cycle.", dest->name);
return FALSE;
}
if (pa_idxset_size(dest->outputs) >= PA_MAX_OUTPUTS_PER_SOURCE) {
pa_log_warn("Failed to move source output: too many outputs per source.");
return FALSE;