RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pipewire | Ubuntu | noble | * |
| Pipewire | Ubuntu | questing | * |
| Pipewire | Ubuntu | resolute | * |
| Pipewire | Ubuntu | upstream | * |