Skip to content
  • Kővágó, Zoltán's avatar
    725662d6
    audio: fix invalid malloc size in audio_create_pdos · 725662d6
    Kővágó, Zoltán authored
    
    
    The code used sizeof(AudiodevAlsaPerDirectionOptions) instead of the
    appropriate per direction options for the audio backend.  If the size of
    the actual audiodev's per direction options are larger than alsa's, it
    could cause a buffer overflow.
    
    However, alsa has three fields in per direction options: a string, an
    uint32 and a bool.  Oss has the same fields, coreaudio has a single
    uint32, paaudio has a string and an uint32, all other backends only use
    the common options, so currently no per direction options struct should
    be larger than alsa's.
    
    Signed-off-by: default avatarKővágó, Zoltán <DirtY.iCE.hu@gmail.com>
    Message-Id: <7808bc816ba7da8b8de8a214713444d85f7af3c6.1566847960.git.DirtY.iCE.hu@gmail.com>
    Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
    725662d6
    audio: fix invalid malloc size in audio_create_pdos
    Kővágó, Zoltán authored
    
    
    The code used sizeof(AudiodevAlsaPerDirectionOptions) instead of the
    appropriate per direction options for the audio backend.  If the size of
    the actual audiodev's per direction options are larger than alsa's, it
    could cause a buffer overflow.
    
    However, alsa has three fields in per direction options: a string, an
    uint32 and a bool.  Oss has the same fields, coreaudio has a single
    uint32, paaudio has a string and an uint32, all other backends only use
    the common options, so currently no per direction options struct should
    be larger than alsa's.
    
    Signed-off-by: default avatarKővágó, Zoltán <DirtY.iCE.hu@gmail.com>
    Message-Id: <7808bc816ba7da8b8de8a214713444d85f7af3c6.1566847960.git.DirtY.iCE.hu@gmail.com>
    Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
Loading