| commit | 4f50d4a48e0caa1aad591f3ca437502e33b8699d | |
| author | Volker Rümelin <vr_qemu@t-online.de> | |
| Tue, 7 Jul 2020 18:08:36 +0000 (7 20:08 +0200) | ||
| committer | Gerd Hoffmann <kraxel@redhat.com> | |
| Mon, 13 Jul 2020 09:38:40 +0000 (13 11:38 +0200) | ||
| tree | cba7b4cc0ab62895529c23386f30766fe4910fab | treesnapshot (tar.gz zip) |
| parent | 9f526fce49c6ac48114ed04914b5a76e4db75785 | commitdiff |
ossaudio: fix out of bounds write
In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.
To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.
Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api"
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-id: 20200707180836.5435-1-vr_qemu@t-online.de
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.
To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.
Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api"
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-id: 20200707180836.5435-1-vr_qemu@t-online.de
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| audio/ossaudio.c | diffblobblamehistory |