mirror of
https://gitlab.freedesktop.org/pipewire/pipewire.git
synced 2026-05-17 10:58:07 +02:00
11226544f7
Input Validation: High The acmp_message() handler accessed fields of avb_ethernet_header and avb_packet_acmp from network packet data without first checking that the received packet was large enough to contain these structures. A short packet could cause out-of-bounds reads when accessing packet header fields. The VLA-based reply buffers in reply_not_supported(), handle_connect_tx_command(), and handle_disconnect_tx_command() also lacked an upper bound on the packet length, allowing a packet claiming a very large size to cause excessive stack allocation. Fix by adding minimum length (sizeof(header) + sizeof(acmp)) and maximum length (MTU) validation at the entry point before any field access or buffer allocation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| daemon | ||
| examples | ||
| gst | ||
| modules | ||
| pipewire | ||
| tests | ||
| tools | ||
| meson.build | ||