[PATCH v2] module-coreaudio-device: do not corrupt the heap/stack for devices with more channels than supported.

[ionic@xxxxxxxx (Mihai Moldovan)]

Instead, clamp the channel number to PA_CHANNELS_MAX. That's better than
overwriting random data, crashing and burning, and arguably better than
skipping the device completely.

Signed-off-by: Mihai Moldovan <ionic at ionic.de>
---
 src/modules/macosx/module-coreaudio-device.c | 34 ++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/src/modules/macosx/module-coreaudio-device.c b/src/modules/macosx/module-coreaudio-device.c
index 366f814..83921b0 100644
--- a/src/modules/macosx/module-coreaudio-device.c
+++ b/src/modules/macosx/module-coreaudio-device.c
@@ -407,21 +407,28 @@ static int ca_device_create_sink(pa_module *m, AudioBuffer *buf, int channel_idx
     pa_sink_flags_t flags = PA_SINK_LATENCY | PA_SINK_HARDWARE;
     coreaudio_sink *ca_sink;
     pa_sink *sink;
-    unsigned int i;
+    unsigned int i, channels;
     char tmp[255];
     pa_strbuf *strbuf;
     AudioObjectPropertyAddress property_address;
     CFStringRef tmp_cfstr = NULL;
 
     ca_sink = pa_xnew0(coreaudio_sink, 1);
-    ca_sink->map.channels = buf->mNumberChannels;
-    ca_sink->ss.channels = buf->mNumberChannels;
+
+    /* Clamp to PA_CHANNELS_MAX. */
+    channels = buf->mNumberChannels;
+    if (channels > PA_CHANNELS_MAX) {
+        channels = PA_CHANNELS_MAX;
+    }
+
+    ca_sink->map.channels = channels;
+    ca_sink->ss.channels = channels;
     ca_sink->channel_idx = channel_idx;
 
     /* build a name for this stream */
     strbuf = pa_strbuf_new();
 
-    for (i = 0; i < buf->mNumberChannels; i++) {
+    for (i = 0; i < channels; i++) {
         property_address.mSelector = kAudioObjectPropertyElementName;
         property_address.mScope = kAudioDevicePropertyScopeOutput;
         property_address.mElement = channel_idx + i + 1;
@@ -452,7 +459,7 @@ static int ca_device_create_sink(pa_module *m, AudioBuffer *buf, int channel_idx
     for (i = 0; i < ca_sink->map.channels; i++)
         ca_sink->map.map[i] = PA_CHANNEL_POSITION_MONO;
 
-    if (buf->mNumberChannels == 2) {
+    if (channels == 2) {
         ca_sink->map.map[0] = PA_CHANNEL_POSITION_LEFT;
         ca_sink->map.map[1] = PA_CHANNEL_POSITION_RIGHT;
     }
@@ -534,21 +541,28 @@ static int ca_device_create_source(pa_module *m, AudioBuffer *buf, int channel_i
     pa_source_flags_t flags = PA_SOURCE_LATENCY | PA_SOURCE_HARDWARE;
     coreaudio_source *ca_source;
     pa_source *source;
-    unsigned int i;
+    unsigned int i, channels;
     char tmp[255];
     pa_strbuf *strbuf;
     AudioObjectPropertyAddress property_address;
     CFStringRef tmp_cfstr = NULL;
 
     ca_source = pa_xnew0(coreaudio_source, 1);
-    ca_source->map.channels = buf->mNumberChannels;
-    ca_source->ss.channels = buf->mNumberChannels;
+
+    /* Clamp to PA_CHANNELS_MAX. */
+    channels = buf->mNumberChannels;
+    if (channels > PA_CHANNELS_MAX) {
+        channels = PA_CHANNELS_MAX;
+    }
+
+    ca_source->map.channels = channels;
+    ca_source->ss.channels = channels;
     ca_source->channel_idx = channel_idx;
 
     /* build a name for this stream */
     strbuf = pa_strbuf_new();
 
-    for (i = 0; i < buf->mNumberChannels; i++) {
+    for (i = 0; i < channels; i++) {
         property_address.mSelector = kAudioObjectPropertyElementName;
         property_address.mScope = kAudioDevicePropertyScopeInput;
         property_address.mElement = channel_idx + i + 1;
@@ -579,7 +593,7 @@ static int ca_device_create_source(pa_module *m, AudioBuffer *buf, int channel_i
     for (i = 0; i < ca_source->map.channels; i++)
         ca_source->map.map[i] = PA_CHANNEL_POSITION_MONO;
 
-    if (buf->mNumberChannels == 2) {
+    if (channels == 2) {
         ca_source->map.map[0] = PA_CHANNEL_POSITION_LEFT;
         ca_source->map.map[1] = PA_CHANNEL_POSITION_RIGHT;
     }
-- 
2.3.5


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4265 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.freedesktop.org/archives/pulseaudio-discuss/attachments/20150420/e1465392/attachment.bin>