sound-file-stream: Fix pulseaudio crash when invalid samples are pushed

memblockq only allows to push aligned data but a invalid file that has
not aligned samples was played though wav-player.

pulseaudio was crashed in pa_memblockq_push function.
pa_assert(uchunk->length % bq->base == 0);

[Version] 13.0-8
[Issue Type] Bugs (TFDF-10411)

Change-Id: I9f117bb3402ef94b46e4b77e7d188f1722f23114
Signed-off-by: Jaechul Lee <jcsing.lee@samsung.com>

diff --git a/packaging/pulseaudio.spec b/packaging/pulseaudio.spec
index 813584f..04d2c60 100644 (file)
--- a/packaging/pulseaudio.spec
+++ b/packaging/pulseaudio.spec
@@ -3,7 +3,7 @@
 Name:             pulseaudio
 Summary:          Improved Linux sound server
 Version:          13.0
-Release:          7
+Release:          8
 Group:            Multimedia/Audio
 License:          LGPL-2.1
 URL:              http://pulseaudio.org

diff --git a/src/pulsecore/sound-file-stream.c b/src/pulsecore/sound-file-stream.c
index bda0cab..8a5aaf9 100644 (file)
--- a/src/pulsecore/sound-file-stream.c
+++ b/src/pulsecore/sound-file-stream.c
@@ -182,6 +182,7 @@ static int sink_input_pop_cb(pa_sink_input *i, size_t length, pa_memchunk *chunk
 #ifdef __TIZEN__
             if (u->repeat == -1 || --u->repeat > 0) {
                 sf_seek(u->sndfile, 0, SEEK_SET);
+                pa_memblock_unref(tchunk.memblock);
                 continue;
             }
 #endif
@@ -194,6 +195,19 @@ static int sink_input_pop_cb(pa_sink_input *i, size_t length, pa_memchunk *chunk
 
         tchunk.length = (size_t) n * fs;
 
+#ifdef __TIZEN__
+        /* check invalid sample size */
+        if (PA_UNLIKELY(tchunk.length % pa_frame_size(&i->sample_spec))) {
+            pa_log_warn("Dropped not aligned samples. length(%zu), fs(%zu)",
+                                tchunk.length, pa_frame_size(&i->sample_spec));
+            tchunk.length = PA_ROUND_DOWN(n, pa_frame_size(&i->sample_spec));
+            if (tchunk.length == 0) {
+                 pa_memblock_unref(tchunk.memblock);
+                 continue;
+            }
+        }
+#endif
+
         pa_memblockq_push(u->memblockq, &tchunk);
         pa_memblock_unref(tchunk.memblock);
     }