Add patches for some crasher bugs

Fixes rhbz#1884177
This commit is contained in:
Wim Taymans 2020-10-01 11:48:20 +02:00
parent de8acccc84
commit 6f5bbefccc
4 changed files with 212 additions and 1 deletions

View File

@ -0,0 +1,25 @@
From 735eefa2fb17219cd2067f084c16f08d42d84aa6 Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Thu, 1 Oct 2020 11:31:52 +0200
Subject: [PATCH] acp: pass right user_data to event
---
spa/plugins/alsa/acp/acp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/spa/plugins/alsa/acp/acp.c b/spa/plugins/alsa/acp/acp.c
index 6106bbba..35a6dfc9 100644
--- a/spa/plugins/alsa/acp/acp.c
+++ b/spa/plugins/alsa/acp/acp.c
@@ -568,7 +568,7 @@ static int hdmi_eld_changed(snd_mixer_elem_t *melem, unsigned int mask)
pa_proplist_as_dict(p->proplist, &p->port.props);
if (changed && mask != 0 && impl->events && impl->events->props_changed)
- impl->events->props_changed(impl);
+ impl->events->props_changed(impl->user_data);
return 0;
}
--
2.26.2

View File

@ -0,0 +1,53 @@
From 81ca70af9bb6c60e2998b4aaf939b82eba257472 Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Mon, 28 Sep 2020 18:23:23 +0200
Subject: [PATCH] alsa-monitor: avoid crash in release
Only try to release the device when we have a proxy.
Fixes #310
---
src/examples/media-session/alsa-monitor.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/src/examples/media-session/alsa-monitor.c b/src/examples/media-session/alsa-monitor.c
index a27370b8..6154d4ca 100644
--- a/src/examples/media-session/alsa-monitor.c
+++ b/src/examples/media-session/alsa-monitor.c
@@ -594,6 +594,12 @@ static void reserve_acquired(void *data, struct rd_device *d)
rd_device_release(device->reserve);
}
+static void complete_release(struct device *device)
+{
+ if (device->reserve)
+ rd_device_complete_release(device->reserve, true);
+}
+
static void sync_complete_done(void *data, int seq)
{
struct device *device = data;
@@ -605,8 +611,7 @@ static void sync_complete_done(void *data, int seq)
spa_hook_remove(&device->sync_listener);
device->seq = 0;
- if (device->reserve)
- rd_device_complete_release(device->reserve, true);
+ complete_release(device);
}
static void sync_destroy(void *data)
@@ -627,6 +632,10 @@ static void reserve_release(void *data, struct rd_device *d, int forced)
struct device *device = data;
pw_log_info("%p: reserve release", device);
+ if (device->sdevice == NULL || device->sdevice->obj.proxy == NULL) {
+ complete_release(device);
+ return;
+ }
set_profile(device, 0);
--
2.26.2

View File

@ -0,0 +1,123 @@
From 0da406d30407f574f4cc28a0e3532aec4dd9fdb6 Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Thu, 1 Oct 2020 11:32:40 +0200
Subject: [PATCH] media-session: make sure we don't read invalid data
---
src/examples/media-session/default-routes.c | 23 ++++++++++++------
src/examples/media-session/restore-stream.c | 26 ++++++++++++++++-----
2 files changed, 36 insertions(+), 13 deletions(-)
diff --git a/src/examples/media-session/default-routes.c b/src/examples/media-session/default-routes.c
index 6c3a4627..ef7fcda3 100644
--- a/src/examples/media-session/default-routes.c
+++ b/src/examples/media-session/default-routes.c
@@ -176,10 +176,13 @@ static int restore_route(struct device *dev, const char *val, uint32_t index, ui
spa_pod_builder_prop(&b, SPA_PARAM_ROUTE_props, 0);
spa_pod_builder_push_object(&b, &f[1],
SPA_TYPE_OBJECT_Props, SPA_PARAM_Route);
- for (p = val; *p; p++) {
+
+ p = val;
+ while (*p) {
if (strstr(p, "volume:") == p) {
- vol = strtof(p+7, &end);
- if (end == p + 7)
+ p += 7;
+ vol = strtof(p, &end);
+ if (end == p)
continue;
spa_pod_builder_prop(&b, SPA_PROP_volume, 0);
spa_pod_builder_float(&b, vol);
@@ -192,14 +195,18 @@ static int restore_route(struct device *dev, const char *val, uint32_t index, ui
p+=6;
}
else if (strstr(p, "volumes:") == p) {
- n_vols = strtol(p+8, &end, 10);
- if (end == p+8 || n_vols >= SPA_AUDIO_MAX_CHANNELS)
+ p += 8;
+ n_vols = strtol(p, &end, 10);
+ if (end == p)
continue;
p = end;
+ if (n_vols >= SPA_AUDIO_MAX_CHANNELS)
+ continue;
vols = alloca(n_vols * sizeof(float));
for (i = 0; i < n_vols && *p == ','; i++) {
- vols[i] = strtof(p+1, &end);
- if (end == p+1)
+ p++;
+ vols[i] = strtof(p, &end);
+ if (end == p)
break;
p = end;
}
@@ -209,6 +216,8 @@ static int restore_route(struct device *dev, const char *val, uint32_t index, ui
spa_pod_builder_prop(&b, SPA_PROP_channelVolumes, 0);
spa_pod_builder_array(&b, sizeof(float), SPA_TYPE_Float,
n_vols, vols);
+ } else {
+ p++;
}
}
spa_pod_builder_pop(&b, &f[1]);
diff --git a/src/examples/media-session/restore-stream.c b/src/examples/media-session/restore-stream.c
index 094a2b1b..237683a3 100644
--- a/src/examples/media-session/restore-stream.c
+++ b/src/examples/media-session/restore-stream.c
@@ -202,9 +202,13 @@ static int restore_stream(struct stream *str, const char *val)
spa_pod_builder_push_object(&b, &f[0],
SPA_TYPE_OBJECT_Props, SPA_PARAM_Props);
- for (p = val; *p; p++) {
+ p = val;
+ while (*p) {
if (strstr(p, "volume:") == p) {
- vol = strtof(p+7, &end);
+ p += 7;
+ vol = strtof(p, &end);
+ if (end == p)
+ continue;
spa_pod_builder_prop(&b, SPA_PROP_volume, 0);
spa_pod_builder_float(&b, vol);
p = end;
@@ -216,15 +220,23 @@ static int restore_stream(struct stream *str, const char *val)
p+=6;
}
else if (strstr(p, "volumes:") == p) {
- n_vols = strtol(p+8, &end, 10);
- if (n_vols >= SPA_AUDIO_MAX_CHANNELS)
+ p += 8;
+ n_vols = strtol(p, &end, 10);
+ if (end == p)
continue;
p = end;
+ if (n_vols >= SPA_AUDIO_MAX_CHANNELS)
+ continue;
vols = alloca(n_vols * sizeof(float));
- for (i = 0; i < n_vols; i++) {
- vols[i] = strtof(p+1, &end);
+ for (i = 0; i < n_vols && *p == ','; i++) {
+ p++;
+ vols[i] = strtof(p, &end);
+ if (end == p)
+ break;
p = end;
}
+ if (i != n_vols)
+ continue;
spa_pod_builder_prop(&b, SPA_PROP_channelVolumes, 0);
spa_pod_builder_array(&b, sizeof(float), SPA_TYPE_Float,
n_vols, vols);
@@ -238,6 +250,8 @@ static int restore_stream(struct stream *str, const char *val)
i = end - p;
strncpy(target, p, i);
target[i-1] = 0;
+ } else {
+ p++;
}
}
param = spa_pod_builder_pop(&b, &f[0]);
--
2.26.2

View File

@ -33,7 +33,7 @@
Name: pipewire
Summary: Media Sharing Server
Version: 0.3.13
Release: 3%{?snap:.%{snap}git%{shortcommit}}%{?dist}
Release: 4%{?snap:.%{snap}git%{shortcommit}}%{?dist}
License: MIT
URL: https://pipewire.org/
%if 0%{?gitrel}
@ -46,6 +46,9 @@ Source0: https://gitlab.freedesktop.org/pipewire/pipewire/-/archive/%{version}/p
## upstream patches
Patch1: 0001-pulse-limit-get_writable_size.patch
Patch2: 0001-alsa-monitor-avoid-crash-in-release.patch
Patch3: 0001-acp-pass-right-user_data-to-event.patch
Patch4: 0001-media-session-make-sure-we-don-t-read-invalid-data.patch
## upstreamable patches
@ -212,6 +215,9 @@ This package provides a PulseAudio implementation based on PipeWire
%patch0 -p1 -b .0000
%patch1 -p1 -b .0001
%patch2 -p1 -b .0002
%patch3 -p1 -b .0003
%patch4 -p1 -b .0004
%build
%meson \
@ -398,6 +404,10 @@ systemctl --no-reload preset --global pipewire.socket >/dev/null 2>&1 || :
%endif
%changelog
* Thu Oct 1 2020 Wim Taymans <wtaymans@redhat.com> - 0.3.13-4
- Add patches for some crasher bugs
- Fixes rhbz#1884177
* Tue Sep 29 2020 Wim Taymans <wtaymans@redhat.com> - 0.3.13-3
- Add patch to improve pulse compatibility