Commit 1d01d5883b for qemu.org

commit 1d01d5883b474bba9024cfb9afe12014ca6393fe
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:22 2026 +0400

    audio/pwaudio: fix integer underflow in qpw_read()

    qpw_read() casts len to int32_t for comparison with int32_t avail,
    which can underflow when avail is negative. Check for non-positive
    avail first, then cast to size_t for the comparison.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: c2d3d1c29415 ("audio/pwaudio.c: Add Pipewire audio backend for QEMU")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-8-ccbef537cbeb@redhat.com>

diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 1105e920f3..a8c18b9ecf 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -247,8 +247,12 @@ qpw_read(HWVoiceIn *hw, void *data, size_t len)
     avail = spa_ringbuffer_get_read_index(&v->ring, &index);

     trace_pw_read(avail, index, len);
+    if (avail <= 0) {
+        l = 0;
+        goto done_unlock;
+    }

-    if (avail < (int32_t) len) {
+    if ((size_t)avail < len) {
         len = avail;
     }