From 97aafe223493dc001161de44ed26dcf1533eb89d Mon Sep 17 00:00:00 2001
From: Wim Taymans <wtaymans@redhat.com>
Date: Tue, 10 Jan 2023 12:30:25 +0100
Subject: [PATCH] fix use_buffers checks

We can set 0 buffers even if there is no format.
Return -ENOSPC when too many buffers are set.
---
 pipewire-jack/src/pipewire-jack.c            |  2 +-
 spa/plugins/alsa/alsa-pcm-sink.c             | 14 ++++++++------
 spa/plugins/alsa/alsa-pcm-source.c           |  8 +++++---
 spa/plugins/alsa/alsa-seq-bridge.c           |  8 +++++---
 spa/plugins/audioconvert/audioconvert.c      |  7 +++++--
 spa/plugins/audiomixer/audiomixer.c          |  7 +++++--
 spa/plugins/audiomixer/mixer-dsp.c           |  7 +++++--
 spa/plugins/audiotestsrc/audiotestsrc.c      |  8 +++++---
 spa/plugins/avb/avb-pcm-sink.c               | 10 +++++-----
 spa/plugins/avb/avb-pcm-source.c             | 10 +++++-----
 spa/plugins/bluez5/media-sink.c              |  8 +++++---
 spa/plugins/bluez5/media-source.c            |  8 +++++---
 spa/plugins/bluez5/sco-sink.c                |  8 +++++---
 spa/plugins/bluez5/sco-source.c              |  8 +++++---
 spa/plugins/control/mixer.c                  |  7 +++++--
 spa/plugins/jack/jack-sink.c                 |  8 +++++---
 spa/plugins/jack/jack-source.c               |  8 +++++---
 spa/plugins/libcamera/libcamera-source.cpp   |  7 ++++---
 spa/plugins/support/null-audio-sink.c        |  8 +++++---
 spa/plugins/test/fakesink.c                  |  8 +++++---
 spa/plugins/test/fakesrc.c                   |  8 +++++---
 spa/plugins/v4l2/v4l2-source.c               |  7 ++++---
 spa/plugins/videotestsrc/videotestsrc.c      |  8 +++++---
 spa/plugins/volume/volume.c                  |  8 +++++---
 spa/plugins/vulkan/vulkan-compute-filter.c   |  8 +++++---
 spa/plugins/vulkan/vulkan-compute-source.c   |  8 +++++---
 src/examples/export-source.c                 |  6 +++++-
 src/examples/local-v4l2.c                    |  6 +++++-
 src/modules/module-client-node/client-node.c |  1 -
 src/pipewire/filter.c                        |  9 ++++++---
 src/pipewire/stream.c                        |  6 +++---
 31 files changed, 146 insertions(+), 88 deletions(-)

diff --git a/pipewire-jack/src/pipewire-jack.c b/pipewire-jack/src/pipewire-jack.c
index ab837f603..b8e84915d 100644
--- a/pipewire-jack/src/pipewire-jack.c
+++ b/pipewire-jack/src/pipewire-jack.c
@@ -2219,7 +2219,7 @@ static int client_node_port_use_buffers(void *data,
 
 	if (n_buffers > MAX_BUFFERS) {
 		pw_log_error("%p: too many buffers %u > %u", c, n_buffers, MAX_BUFFERS);
-		return -EINVAL;
+		return -ENOSPC;
 	}
 
 	if (p->object->port.type_id == TYPE_ID_VIDEO && direction == SPA_DIRECTION_INPUT) {
diff --git a/spa/plugins/alsa/alsa-pcm-sink.c b/spa/plugins/alsa/alsa-pcm-sink.c
index 73c421eec..260550305 100644
--- a/spa/plugins/alsa/alsa-pcm-sink.c
+++ b/spa/plugins/alsa/alsa-pcm-sink.c
@@ -731,6 +731,7 @@ impl_node_port_use_buffers(void *object,
 {
 	struct state *this = object;
 	uint32_t i;
+	int res;
 
 	spa_return_val_if_fail(this != NULL, -EINVAL);
 
@@ -738,14 +739,15 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "%p: use %d buffers", this, n_buffers);
 
-	if (!this->have_format)
-		return -EIO;
-
-	if (n_buffers == 0) {
+	if (this->n_buffers > 0) {
 		spa_alsa_pause(this);
-		clear_buffers(this);
-		return 0;
+		if ((res = clear_buffers(this)) < 0)
+			return res;
 	}
+	if (n_buffers > 0 && !this->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
 
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &this->buffers[i];
diff --git a/spa/plugins/alsa/alsa-pcm-source.c b/spa/plugins/alsa/alsa-pcm-source.c
index 7f72d53ab..f079bf6f4 100644
--- a/spa/plugins/alsa/alsa-pcm-source.c
+++ b/spa/plugins/alsa/alsa-pcm-source.c
@@ -673,9 +673,6 @@ impl_node_port_use_buffers(void *object,
 
 	spa_return_val_if_fail(CHECK_PORT(this, direction, port_id), -EINVAL);
 
-	if (!this->have_format)
-		return -EIO;
-
 	spa_log_debug(this->log, "%p: use %d buffers", this, n_buffers);
 
 	if (this->n_buffers > 0) {
@@ -683,6 +680,11 @@ impl_node_port_use_buffers(void *object,
 		if ((res = clear_buffers(this)) < 0)
 			return res;
 	}
+	if (n_buffers > 0 && !this->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &this->buffers[i];
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/alsa/alsa-seq-bridge.c b/spa/plugins/alsa/alsa-seq-bridge.c
index 4ec8e3c6e..ee50163c4 100644
--- a/spa/plugins/alsa/alsa-seq-bridge.c
+++ b/spa/plugins/alsa/alsa-seq-bridge.c
@@ -748,11 +748,13 @@ impl_node_port_use_buffers(void *object,
 	spa_log_debug(this->log, "%p: port %d.%d buffers:%d format:%d", this,
 			direction, port_id, n_buffers, port->have_format);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/audioconvert/audioconvert.c b/spa/plugins/audioconvert/audioconvert.c
index ccf4e30c5..578f70ff9 100644
--- a/spa/plugins/audioconvert/audioconvert.c
+++ b/spa/plugins/audioconvert/audioconvert.c
@@ -2049,13 +2049,16 @@ impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	spa_return_val_if_fail(port->have_format, -EIO);
-
 	spa_log_debug(this->log, "%p: use buffers %d on port %d:%d",
 			this, n_buffers, direction, port_id);
 
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	maxsize = this->quantum_limit * sizeof(float);
 
 	for (i = 0; i < n_buffers; i++) {
diff --git a/spa/plugins/audiomixer/audiomixer.c b/spa/plugins/audiomixer/audiomixer.c
index 41e7e3f7e..25da9780a 100644
--- a/spa/plugins/audiomixer/audiomixer.c
+++ b/spa/plugins/audiomixer/audiomixer.c
@@ -649,10 +649,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	spa_return_val_if_fail(port->have_format, -EIO);
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/audiomixer/mixer-dsp.c b/spa/plugins/audiomixer/mixer-dsp.c
index f93796b97..534cfabaf 100644
--- a/spa/plugins/audiomixer/mixer-dsp.c
+++ b/spa/plugins/audiomixer/mixer-dsp.c
@@ -586,10 +586,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	spa_return_val_if_fail(port->have_format, -EIO);
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/audiotestsrc/audiotestsrc.c b/spa/plugins/audiotestsrc/audiotestsrc.c
index c0c9c7a68..1501e1d55 100644
--- a/spa/plugins/audiotestsrc/audiotestsrc.c
+++ b/spa/plugins/audiotestsrc/audiotestsrc.c
@@ -829,11 +829,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = &this->port;
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/avb/avb-pcm-sink.c b/spa/plugins/avb/avb-pcm-sink.c
index 00f4e9593..0a102480c 100644
--- a/spa/plugins/avb/avb-pcm-sink.c
+++ b/spa/plugins/avb/avb-pcm-sink.c
@@ -629,14 +629,14 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "%p: use %d buffers", this, n_buffers);
 
-	if (!port->have_format)
-		return -EIO;
-
-	if (n_buffers == 0) {
+	if (port->n_buffers > 0) {
 		spa_avb_pause(this);
 		clear_buffers(this, port);
-		return 0;
 	}
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
 
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
diff --git a/spa/plugins/avb/avb-pcm-source.c b/spa/plugins/avb/avb-pcm-source.c
index 5bf0a6e51..e7891a1a8 100644
--- a/spa/plugins/avb/avb-pcm-source.c
+++ b/spa/plugins/avb/avb-pcm-source.c
@@ -629,14 +629,14 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "%p: use %d buffers", this, n_buffers);
 
-	if (!port->have_format)
-		return -EIO;
-
-	if (n_buffers == 0) {
+	if (port->n_buffers > 0) {
 		spa_avb_pause(this);
 		clear_buffers(this, port);
-		return 0;
 	}
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
 
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
diff --git a/spa/plugins/bluez5/media-sink.c b/spa/plugins/bluez5/media-sink.c
index 4bf7310cf..cab508ffc 100644
--- a/spa/plugins/bluez5/media-sink.c
+++ b/spa/plugins/bluez5/media-sink.c
@@ -1453,11 +1453,13 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "use buffers %d", n_buffers);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
 
diff --git a/spa/plugins/bluez5/media-source.c b/spa/plugins/bluez5/media-source.c
index d260335ce..360f812bd 100644
--- a/spa/plugins/bluez5/media-source.c
+++ b/spa/plugins/bluez5/media-source.c
@@ -1202,11 +1202,13 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "use buffers %d", n_buffers);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/bluez5/sco-sink.c b/spa/plugins/bluez5/sco-sink.c
index 7025c78a9..18a34f64b 100644
--- a/spa/plugins/bluez5/sco-sink.c
+++ b/spa/plugins/bluez5/sco-sink.c
@@ -1186,11 +1186,13 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "use buffers %d", n_buffers);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
 
diff --git a/spa/plugins/bluez5/sco-source.c b/spa/plugins/bluez5/sco-source.c
index b4c40983a..6f5fe08fd 100644
--- a/spa/plugins/bluez5/sco-source.c
+++ b/spa/plugins/bluez5/sco-source.c
@@ -1155,11 +1155,13 @@ impl_node_port_use_buffers(void *object,
 
 	spa_log_debug(this->log, "use buffers %d", n_buffers);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &port->buffers[i];
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/control/mixer.c b/spa/plugins/control/mixer.c
index 1ef212b46..9d28bef3d 100644
--- a/spa/plugins/control/mixer.c
+++ b/spa/plugins/control/mixer.c
@@ -506,10 +506,13 @@ impl_node_port_use_buffers(void *object,
 	spa_log_debug(this->log, NAME " %p: use buffers %d on port %d:%d",
 			this, n_buffers, direction, port_id);
 
-	spa_return_val_if_fail(port->have_format, -EIO);
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/jack/jack-sink.c b/spa/plugins/jack/jack-sink.c
index 50dec321b..e9ca5a8bc 100644
--- a/spa/plugins/jack/jack-sink.c
+++ b/spa/plugins/jack/jack-sink.c
@@ -693,11 +693,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 
diff --git a/spa/plugins/jack/jack-source.c b/spa/plugins/jack/jack-source.c
index 7a82f0768..7004eed12 100644
--- a/spa/plugins/jack/jack-source.c
+++ b/spa/plugins/jack/jack-source.c
@@ -693,11 +693,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 
diff --git a/spa/plugins/libcamera/libcamera-source.cpp b/spa/plugins/libcamera/libcamera-source.cpp
index 50954e5e3..26ef14874 100644
--- a/spa/plugins/libcamera/libcamera-source.cpp
+++ b/spa/plugins/libcamera/libcamera-source.cpp
@@ -774,14 +774,15 @@ static int impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(impl, direction, port_id);
 
-	if (!port->current_format)
-		return -EIO;
-
 	if (port->n_buffers) {
 		spa_libcamera_stream_off(impl);
 		if ((res = spa_libcamera_clear_buffers(impl, port)) < 0)
 			return res;
 	}
+	if (n_buffers > 0 && !port->current_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
 	if (buffers == NULL)
 		return 0;
 
diff --git a/spa/plugins/support/null-audio-sink.c b/spa/plugins/support/null-audio-sink.c
index c39c15afb..e5b9f04a7 100644
--- a/spa/plugins/support/null-audio-sink.c
+++ b/spa/plugins/support/null-audio-sink.c
@@ -685,11 +685,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = &this->port;
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/test/fakesink.c b/spa/plugins/test/fakesink.c
index 3c42b2239..16bb012d0 100644
--- a/spa/plugins/test/fakesink.c
+++ b/spa/plugins/test/fakesink.c
@@ -585,11 +585,13 @@ impl_node_port_use_buffers(void *object,
 	spa_return_val_if_fail(CHECK_PORT(this, direction, port_id), -EINVAL);
 	port = &this->port;
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/test/fakesrc.c b/spa/plugins/test/fakesrc.c
index d4965a98b..f41454323 100644
--- a/spa/plugins/test/fakesrc.c
+++ b/spa/plugins/test/fakesrc.c
@@ -597,11 +597,13 @@ impl_node_port_use_buffers(void *object,
 	spa_return_val_if_fail(CHECK_PORT(this, direction, port_id), -EINVAL);
 	port = &this->port;
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/v4l2/v4l2-source.c b/spa/plugins/v4l2/v4l2-source.c
index 3d967f255..cd859463c 100644
--- a/spa/plugins/v4l2/v4l2-source.c
+++ b/spa/plugins/v4l2/v4l2-source.c
@@ -756,14 +756,15 @@ static int impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	if (!port->have_format)
-		return -EIO;
-
 	if (port->n_buffers) {
 		spa_v4l2_stream_off(this);
 		if ((res = spa_v4l2_clear_buffers(this)) < 0)
 			return res;
 	}
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
 	if (buffers == NULL)
 		return 0;
 
diff --git a/spa/plugins/videotestsrc/videotestsrc.c b/spa/plugins/videotestsrc/videotestsrc.c
index af3bc9688..8d96b1b38 100644
--- a/spa/plugins/videotestsrc/videotestsrc.c
+++ b/spa/plugins/videotestsrc/videotestsrc.c
@@ -712,11 +712,13 @@ impl_node_port_use_buffers(void *object,
 	spa_return_val_if_fail(CHECK_PORT(this, direction, port_id), -EINVAL);
 	port = &this->port;
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/volume/volume.c b/spa/plugins/volume/volume.c
index 08102a428..63237661e 100644
--- a/spa/plugins/volume/volume.c
+++ b/spa/plugins/volume/volume.c
@@ -528,11 +528,13 @@ impl_node_port_use_buffers(void *object,
 
 	port = GET_PORT(this, direction, port_id);
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 		struct spa_data *d = buffers[i]->datas;
diff --git a/spa/plugins/vulkan/vulkan-compute-filter.c b/spa/plugins/vulkan/vulkan-compute-filter.c
index 66157075a..94efec3aa 100644
--- a/spa/plugins/vulkan/vulkan-compute-filter.c
+++ b/spa/plugins/vulkan/vulkan-compute-filter.c
@@ -505,11 +505,13 @@ impl_node_port_use_buffers(void *object,
 	spa_return_val_if_fail(CHECK_PORT(this, direction, port_id), -EINVAL);
 	port = &this->port[direction];
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 
diff --git a/spa/plugins/vulkan/vulkan-compute-source.c b/spa/plugins/vulkan/vulkan-compute-source.c
index dade5a5d3..4602e5d52 100644
--- a/spa/plugins/vulkan/vulkan-compute-source.c
+++ b/spa/plugins/vulkan/vulkan-compute-source.c
@@ -740,11 +740,13 @@ impl_node_port_use_buffers(void *object,
 	spa_return_val_if_fail(CHECK_PORT(this, direction, port_id), -EINVAL);
 	port = &this->port;
 
-	if (!port->have_format)
-		return -EIO;
-
 	clear_buffers(this, port);
 
+	if (n_buffers > 0 && !port->have_format)
+		return -EIO;
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b;
 
diff --git a/src/examples/export-source.c b/src/examples/export-source.c
index 22dfa1426..eb8fdb5ac 100644
--- a/src/examples/export-source.c
+++ b/src/examples/export-source.c
@@ -46,6 +46,7 @@
 #define M_PI_M2 ( M_PI + M_PI )
 
 #define BUFFER_SAMPLES	128
+#define MAX_BUFFERS	32
 
 struct buffer {
 	uint32_t id;
@@ -79,7 +80,7 @@ struct data {
 
 	struct spa_audio_info_raw format;
 
-	struct buffer buffers[32];
+	struct buffer buffers[MAX_BUFFERS];
 	uint32_t n_buffers;
 	struct spa_list empty;
 
@@ -325,6 +326,9 @@ static int impl_port_use_buffers(void *object,
 	struct data *d = object;
 	uint32_t i;
 
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		struct buffer *b = &d->buffers[i];
 		struct spa_data *datas = buffers[i]->datas;
diff --git a/src/examples/local-v4l2.c b/src/examples/local-v4l2.c
index 5f7476727..1d70e9ec1 100644
--- a/src/examples/local-v4l2.c
+++ b/src/examples/local-v4l2.c
@@ -34,6 +34,7 @@
 #define WIDTH   640
 #define HEIGHT  480
 #define BPP    3
+#define MAX_BUFFERS	32
 
 #include "sdl.h"
 
@@ -68,7 +69,7 @@ struct data {
 	struct spa_video_info_raw format;
 	int32_t stride;
 
-	struct spa_buffer *buffers[32];
+	struct spa_buffer *buffers[MAX_BUFFERS];
 	int n_buffers;
 
 	struct pw_proxy *out, *in, *link;
@@ -264,6 +265,9 @@ static int impl_port_use_buffers(void *object,
 	struct data *d = object;
 	uint32_t i;
 
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++)
 		d->buffers[i] = buffers[i];
 	d->n_buffers = n_buffers;
diff --git a/src/modules/module-client-node/client-node.c b/src/modules/module-client-node/client-node.c
index 563585553..b1f58289f 100644
--- a/src/modules/module-client-node/client-node.c
+++ b/src/modules/module-client-node/client-node.c
@@ -754,7 +754,6 @@ do_port_use_buffers(struct impl *impl,
 	if (n_buffers > MAX_BUFFERS)
 		return -ENOSPC;
 
-
 	spa_log_debug(this->log, "%p: %s port %d.%d use buffers %p %u flags:%08x", this,
 			direction == SPA_DIRECTION_INPUT ? "input" : "output",
 			port_id, mix_id, buffers, n_buffers, flags);
diff --git a/src/pipewire/filter.c b/src/pipewire/filter.c
index 4af39fbbe..cc18606b9 100644
--- a/src/pipewire/filter.c
+++ b/src/pipewire/filter.c
@@ -885,16 +885,19 @@ static int impl_port_use_buffers(void *object,
 	pw_log_debug("%p: port:%d.%d buffers:%u disconnecting:%d", impl,
 			direction, port_id, n_buffers, impl->disconnecting);
 
+	if ((port = get_port(impl, direction, port_id)) == NULL)
+		return -EINVAL;
+
 	if (impl->disconnecting && n_buffers > 0)
 		return -EIO;
 
-	if ((port = get_port(impl, direction, port_id)) == NULL)
-		return -EINVAL;
+	clear_buffers(port);
 
 	impl_flags = port->flags;
 	prot = PROT_READ | (direction == SPA_DIRECTION_OUTPUT ? PROT_WRITE : 0);
 
-	clear_buffers(port);
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
 
 	for (i = 0; i < n_buffers; i++) {
 		int buf_size = 0;
diff --git a/src/pipewire/stream.c b/src/pipewire/stream.c
index a7c1da187..3b0d8adb4 100644
--- a/src/pipewire/stream.c
+++ b/src/pipewire/stream.c
@@ -922,13 +922,13 @@ static int impl_port_use_buffers(void *object,
 	if (impl->disconnecting && n_buffers > 0)
 		return -EIO;
 
-	if (n_buffers > MAX_BUFFERS)
-		return -EINVAL;
-
 	prot = PROT_READ | (direction == SPA_DIRECTION_OUTPUT ? PROT_WRITE : 0);
 
 	clear_buffers(stream);
 
+	if (n_buffers > MAX_BUFFERS)
+		return -ENOSPC;
+
 	for (i = 0; i < n_buffers; i++) {
 		int buf_size = 0;
 		struct buffer *b = &impl->buffers[i];
-- 
GitLab