qpw_write() and qpw_buffer_get_free() do not handle negative avail (highwater_mark - filled), which can occur transiently. In qpw_buffer_get_free(), clamp to zero. In qpw_write(), bail out early and fix the signed/unsigned comparison with len.
Reported-by: Pavee Hui <[email protected]> Fixes: c2d3d1c29415 ("audio/pwaudio.c: Add Pipewire audio backend for QEMU") Signed-off-by: Marc-André Lureau <[email protected]> --- audio/pwaudio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/audio/pwaudio.c b/audio/pwaudio.c index a8c18b9ecf85..8b3faae8a907 100644 --- a/audio/pwaudio.c +++ b/audio/pwaudio.c @@ -286,6 +286,9 @@ static size_t qpw_buffer_get_free(HWVoiceOut *hw) filled = spa_ringbuffer_get_write_index(&v->ring, &index); avail = v->highwater_mark - filled; + if (avail < 0) { + avail = 0; + } done_unlock: pw_thread_loop_unlock(c->thread_loop); @@ -312,8 +315,12 @@ qpw_write(HWVoiceOut *hw, void *data, size_t len) avail = v->highwater_mark - filled; trace_pw_write(filled, avail, index, len); + if (avail <= 0) { + len = 0; + goto done_unlock; + } - if (len > avail) { + if (len > (size_t)avail) { len = avail; } -- 2.56.0.rc0.29.g47ce80527c56
