Bug 71823 - ucm: Unsafe assertion (configuration error crashes pulseaudio)
Summary: ucm: Unsafe assertion (configuration error crashes pulseaudio)
Alias: None
Product: PulseAudio
Classification: Unclassified
Component: alsa (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: pulseaudio-bugs
QA Contact: pulseaudio-bugs
Keywords: love
Depends on:
Reported: 2013-11-20 07:20 UTC by Tanu Kaskinen
Modified: 2018-07-30 10:31 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Description Tanu Kaskinen 2013-11-20 07:20:34 UTC
In alsa_mapping_add_ucm_modifier() there's this code:

    /* save mapping to ucm modifier */
    if (m->direction == PA_ALSA_DIRECTION_OUTPUT) {
        modifier->playback_mapping = m;
        channel_str = pa_proplist_gets(modifier->proplist, PA_ALSA_PROP_UCM_PLAYBACK_CHANNELS);
    } else {
        modifier->capture_mapping = m;
        channel_str = pa_proplist_gets(modifier->proplist, PA_ALSA_PROP_UCM_CAPTURE_CHANNELS);
    if (channel_str) {
        pa_assert_se(pa_atou(channel_str, &channels) == 0 && channels < PA_CHANNELS_MAX);
        pa_log_debug("Got channel count %" PRIu32 " for modifier", channels);

If I understand the code correctly, the channels property comes directly from the UCM configuration file, and the correctness of the property is not checked before this point. Therefore, if the channels are misconfigured in UCM, that will crash PulseAudio. That should never happen. Proper error handling is needed here. One complication is that the function can't currently fail. I haven't checked how much effort it would take to change the function so that it could fail - it may be easy, or it may propagate further. Another option would be to validate the channels property at some earlier stage.
Comment 1 GitLab Migration User 2018-07-30 10:31:35 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/pulseaudio/pulseaudio/issues/485.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.