security/hakurei
security/hakurei
6
3
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 9 Wiki Activity

internal/pipewire: spa_dict trailing garbage within POD
All checks were successful
Test / Create distribution (push) Successful in 42s
Details
Test / Sandbox (push) Successful in 1m30s
Details
Test / Hakurei (push) Successful in 2m26s
Details
Test / Hpkg (push) Successful in 3m20s
Details
Test / Sandbox (race detector) (push) Successful in 4m21s
Details
Test / Hakurei (race detector) (push) Successful in 5m11s
Details
Test / Flake checks (push) Successful in 1m24s
Details

Browse Source 
This performs the check within the bounds of the POD only. This was not caught since spa_dict was only used as the final struct field until now.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-11-25 13:39:02 +09:00
parent b1b27ac1df
commit a0eb010aab
Signed by: cat
SSH Key Fingerprint: SHA256:wr6yH7sDDbUFi81k/GsIGwpM3O2QrwqYlLF26CcJa4w
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/pipewire/pod.go
View File

@ -400,6 +400,8 @@ func (d *SPADict) UnmarshalPOD(data []byte) (Word, error) {
if err := unmarshalCheckTypeBounds(&data, SPA_TYPE_Struct, &wireSize); err != nil { if err := unmarshalCheckTypeBounds(&data, SPA_TYPE_Struct, &wireSize); err != nil {
return wireSize, err return wireSize, err
} }
// bounds check completed in successful call to unmarshalCheckTypeBounds
data = data[:wireSize]
if size, err := Unmarshal(data, &d.NItems); err != nil { if size, err := Unmarshal(data, &d.NItems); err != nil {
return wireSize, err return wireSize, err