qpw_read() casts len to int32_t for comparison with int32_t avail, which can underflow when avail is negative. Check for non-positive avail first, then cast to size_t for the comparison.
Reported-by: Pavee Hui <[email protected]> Fixes: c2d3d1c29415 ("audio/pwaudio.c: Add Pipewire audio backend for QEMU") Signed-off-by: Marc-André Lureau <[email protected]> --- audio/pwaudio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/audio/pwaudio.c b/audio/pwaudio.c index 1105e920f3c2..a8c18b9ecf85 100644 --- a/audio/pwaudio.c +++ b/audio/pwaudio.c @@ -247,8 +247,12 @@ qpw_read(HWVoiceIn *hw, void *data, size_t len) avail = spa_ringbuffer_get_read_index(&v->ring, &index); trace_pw_read(avail, index, len); + if (avail <= 0) { + l = 0; + goto done_unlock; + } - if (avail < (int32_t) len) { + if ((size_t)avail < len) { len = avail; } -- 2.56.0.rc0.29.g47ce80527c56
