fdo-mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-12-20 06:50:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

bluez5: fix parsing of 0-element dbus arrays

Browse source 
Type checking by recurse + get_arg_type is wrong for 0-element arrays.
Just check from iterator signature.

Also avoid relying on malloc(0) != NULL
This commit is contained in:
Pauli Virtanen 2025-12-06 11:22:44 +02:00 • committed by Wim Taymans
parent f65d5654d3
commit c623886625
1 changed files with 14 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
spa/plugins/bluez5/bluez5-dbus.c
View file

@ -922,24 +922,24 @@ static int parse_endpoint_props(struct spa_bt_monitor *monitor, DBusMessageIter
spa_assert(dest && size); spa_assert(dest && size);
if (type != DBUS_TYPE_ARRAY) if (!check_iter_signature(&it[1], "ay"))
goto bad_property; goto bad_property;
dbus_message_iter_recurse(&it[1], &it[2]); dbus_message_iter_recurse(&it[1], &it[2]);
type = dbus_message_iter_get_arg_type(&it[2]);
if (type != DBUS_TYPE_BYTE)
goto bad_property;
dbus_message_iter_get_fixed_array(&it[2], &data, &n); dbus_message_iter_get_fixed_array(&it[2], &data, &n);
buf = malloc(n); if (n) {
if (!buf) buf = malloc(n);
return -ENOMEM; if (!buf)
return -ENOMEM;
memcpy(buf, data, n);
} else {
buf = NULL;
}
free(*dest); free(*dest);
*dest = buf; *dest = buf;
*size = n; *size = n;
memcpy(buf, data, n);
spa_log_info(monitor->log, "%p: %s size:%zu", monitor, key, *size); spa_log_info(monitor->log, "%p: %s size:%zu", monitor, key, *size);
spa_debug_log_mem(monitor->log, SPA_LOG_LEVEL_DEBUG, ' ', *dest, *size); spa_debug_log_mem(monitor->log, SPA_LOG_LEVEL_DEBUG, ' ', *dest, *size);
@ -3650,6 +3650,11 @@ static int transport_update_props(struct spa_bt_transport *transport,
free(transport->configuration); free(transport->configuration);
transport->configuration_len = 0; transport->configuration_len = 0;
if (!len) {
transport->configuration = NULL;
goto next;
}
transport->configuration = malloc(len); transport->configuration = malloc(len);
if (transport->configuration) { if (transport->configuration) {
memcpy(transport->configuration, value, len); memcpy(transport->configuration, value, len);