pipewire/src
Wim Taymans d4ec630b2f security: fix missing packet length validation in VBAN MIDI receive
Memory Safety: High

In vban_midi_receive(), the received buffer is cast to struct
vban_header and its n_frames field is accessed before validating
that the packet is large enough to contain the header. A truncated
packet shorter than VBAN_HEADER_SIZE would cause an out-of-bounds
read.

Fix by checking that len >= VBAN_HEADER_SIZE before accessing the
header, matching the fix applied to vban_audio_receive().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-24 15:55:35 +02:00
..
daemon filter-chain: update virtual surround with convolver2 2026-04-21 17:03:55 +02:00
examples impl-node: accept more node.passive values 2026-03-12 17:25:36 +01:00
gst gst: fix crop height typo in pipewiresink do_send_buffer 2026-04-21 20:19:24 +01:00
modules security: fix missing packet length validation in VBAN MIDI receive 2026-04-24 15:55:35 +02:00
pipewire security: fix missing fdopen() NULL check in conf.c 2026-04-23 17:45:29 +02:00
tests stream: return -EIO when doing get_time in != STREAMING 2026-02-12 12:26:33 +01:00
tools security: fix integer overflow in DSF file buffer allocation 2026-04-23 16:59:14 +02:00
meson.build meson.build: fix compile with -Dexamples=disabled 2023-11-28 10:18:25 +00:00