From a0eb010aaba24e4cf20aedc04a2dc5fea5ec140c Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 25 Nov 2025 13:39:02 +0900 Subject: [PATCH] internal/pipewire: spa_dict trailing garbage within POD This performs the check within the bounds of the POD only. This was not caught since spa_dict was only used as the final struct field until now. Signed-off-by: Ophestra --- internal/pipewire/pod.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/internal/pipewire/pod.go b/internal/pipewire/pod.go index 9fb9c78..0faada2 100644 --- a/internal/pipewire/pod.go +++ b/internal/pipewire/pod.go @@ -400,6 +400,8 @@ func (d *SPADict) UnmarshalPOD(data []byte) (Word, error) { if err := unmarshalCheckTypeBounds(&data, SPA_TYPE_Struct, &wireSize); err != nil { return wireSize, err } + // bounds check completed in successful call to unmarshalCheckTypeBounds + data = data[:wireSize] if size, err := Unmarshal(data, &d.NItems); err != nil { return wireSize, err