forked from security/hakurei
internal/pipewire: spa_dict trailing garbage within POD
This performs the check within the bounds of the POD only. This was not caught since spa_dict was only used as the final struct field until now. Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
@@ -400,6 +400,8 @@ func (d *SPADict) UnmarshalPOD(data []byte) (Word, error) {
|
||||
if err := unmarshalCheckTypeBounds(&data, SPA_TYPE_Struct, &wireSize); err != nil {
|
||||
return wireSize, err
|
||||
}
|
||||
// bounds check completed in successful call to unmarshalCheckTypeBounds
|
||||
data = data[:wireSize]
|
||||
|
||||
if size, err := Unmarshal(data, &d.NItems); err != nil {
|
||||
return wireSize, err
|
||||
|
||||
Reference in New Issue
Block a user