From: Seungbae Shin <seungbae.shin@samsung.com>
Date: Thu, 21 Apr 2022 03:52:07 +0000 (+0900)
Subject: sound-player: Fix INTEGER_OVERFLOW defect
X-Git-Tag: submit/tizen/20220422.071822~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=1a8e6880d70f0705c4c6e5917a34bee3a56baf14;p=platform%2Fcore%2Fmultimedia%2Fpulseaudio-modules-tizen.git

sound-player: Fix INTEGER_OVERFLOW defect

[Version] 15.0.11
[Issue Type] Svace

Change-Id: I224d3ac72c27a1b184baf72933bbe5618a073d45
---

diff --git a/packaging/pulseaudio-modules-tizen.spec b/packaging/pulseaudio-modules-tizen.spec
index 2611033..9122970 100644
--- a/packaging/pulseaudio-modules-tizen.spec
+++ b/packaging/pulseaudio-modules-tizen.spec
@@ -2,7 +2,7 @@
 
 Name:             pulseaudio-modules-tizen
 Summary:          Pulseaudio modules for Tizen
-Version:          15.0.10
+Version:          15.0.11
 Release:          0
 Group:            Multimedia/Audio
 License:          LGPL-2.1+
diff --git a/src/module-sound-player.c b/src/module-sound-player.c
index 16212ae..ce505a8 100644
--- a/src/module-sound-player.c
+++ b/src/module-sound-player.c
@@ -711,12 +711,12 @@ static void deinit_ipc(struct userdata *u) {
 #endif
 }
 
-static void io_event_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_io_event_flags_t events, void*userdata) {
+static void io_event_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_io_event_flags_t events, void *userdata) {
     struct userdata *u = userdata;
     struct ipc_data data;
-    int ret = 0;
-    int data_size = 0;
-    int read_sum = 0;
+    ssize_t ret = 0;
+    size_t data_size = 0;
+    size_t read_sum = 0;
     int retry_count = 0;
 
     pa_assert(io);
@@ -728,15 +728,18 @@ static void io_event_callback(pa_mainloop_api *io, pa_io_event *e, int fd, pa_io
     }
 
     if (events & PA_IO_EVENT_INPUT) {
-        data_size = sizeof(data);
+        data_size = sizeof(struct ipc_data);
         memset(&data, 0, data_size);
+
         while (read_sum != data_size && retry_count < RETRY_NUM) {
-            ret = read(fd, (void*)(((char *)&data)+read_sum), data_size-read_sum);
-            if (ret < 0 && errno == EAGAIN)
+            ret = read(fd, (void *)(((char *)&data) + read_sum), data_size - read_sum);
+            if (ret < 0) {
                 retry_count++;
-            else
-                read_sum += ret;
+                continue;
+            }
+            read_sum += (size_t)ret;
         }
+
         if (read_sum == data_size) {
             pa_log_info("name(%s), role(%s), volume_gain_type(%s), method(%s)",
                     data.filename, data.role, data.volume_gain_type, data.method);