<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - ucm: Unsafe assertion (configuration error crashes pulseaudio)"
href="https://bugs.freedesktop.org/show_bug.cgi?id=71823">71823</a>
</td>
</tr>
<tr>
<th>CC</th>
<td>lennart@poettering.net
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pulseaudio-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>ucm: Unsafe assertion (configuration error crashes pulseaudio)
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>pulseaudio-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Reporter</th>
<td>tanuk@iki.fi
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Component</th>
<td>alsa
</td>
</tr>
<tr>
<th>Product</th>
<td>PulseAudio
</td>
</tr></table>
<p>
<div>
<pre>In alsa_mapping_add_ucm_modifier() there's this code:
/* save mapping to ucm modifier */
if (m->direction == PA_ALSA_DIRECTION_OUTPUT) {
modifier->playback_mapping = m;
channel_str = pa_proplist_gets(modifier->proplist,
PA_ALSA_PROP_UCM_PLAYBACK_CHANNELS);
} else {
modifier->capture_mapping = m;
channel_str = pa_proplist_gets(modifier->proplist,
PA_ALSA_PROP_UCM_CAPTURE_CHANNELS);
}
if (channel_str) {
pa_assert_se(pa_atou(channel_str, &channels) == 0 && channels <
PA_CHANNELS_MAX);
pa_log_debug("Got channel count %" PRIu32 " for modifier", channels);
}
If I understand the code correctly, the channels property comes directly from
the UCM configuration file, and the correctness of the property is not checked
before this point. Therefore, if the channels are misconfigured in UCM, that
will crash PulseAudio. That should never happen. Proper error handling is
needed here. One complication is that the function can't currently fail. I
haven't checked how much effort it would take to change the function so that it
could fail - it may be easy, or it may propagate further. Another option would
be to validate the channels property at some earlier stage.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>