Skip to content

Commit

Permalink
PulseAudio: stricter pa_stream_peek() validation.
Browse files Browse the repository at this point in the history
An uncommon condition in the pa_stream_peek function
('no data at current read index') wasn't handled properly
and could lead to a segfault.

The commit also adds checks for other pa_stream_peek
error scenarios.

Fixes #1316
  • Loading branch information
mkrautz committed Jul 20, 2014
1 parent 322ed8a commit e740ea5
Showing 1 changed file with 15 additions and 3 deletions.
18 changes: 15 additions & 3 deletions src/mumble/PulseAudio.cpp
Expand Up @@ -455,8 +455,16 @@ void PulseAudioSystem::read_callback(pa_stream *s, size_t bytes, void *userdata)
PulseAudioSystem *pas = reinterpret_cast<PulseAudioSystem *>(userdata);

size_t length = bytes;
const void *data;
const void *data = NULL;
pa_stream_peek(s, &data, &length);
if (data == NULL && length > 0) {
qWarning("PulseAudio: pa_stream_peek reports no data at current read index.");
} else if (data == NULL && length == 0) {
qWarning("PulseAudio: pa_stream_peek reports empty memblockq.");
} else if (data == NULL || length == 0) {
qWarning("PulseAudio: invalid pa_stream_peek state encountered.");
return;
}

AudioInputPtr ai = g.ai;
PulseAudioInput *pai = dynamic_cast<PulseAudioInput *>(ai.get());
Expand All @@ -479,7 +487,9 @@ void PulseAudioSystem::read_callback(pa_stream *s, size_t bytes, void *userdata)
pai->eMicFormat = PulseAudioInput::SampleShort;
pai->initializeMixer();
}
pai->addMic(data, length / pai->iMicSampleSize);
if (data != NULL) {
pai->addMic(data, length / pai->iMicSampleSize);
}
} else if (s == pas->pasSpeaker) {
if (!pa_sample_spec_equal(pss, &pai->pssEcho)) {
pai->pssEcho = *pss;
Expand All @@ -491,7 +501,9 @@ void PulseAudioSystem::read_callback(pa_stream *s, size_t bytes, void *userdata)
pai->eEchoFormat = PulseAudioInput::SampleShort;
pai->initializeMixer();
}
pai->addEcho(data, length / pai->iEchoSampleSize);
if (data != NULL) {
pai->addEcho(data, length / pai->iEchoSampleSize);
}
}

pa_stream_drop(s);
Expand Down

0 comments on commit e740ea5

Please sign in to comment.