lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 10/58] ALSA: opl3: fix infoleak in opl3
    Date
    From: xidongwang <wangxidong_97@163.com>

    commit ad155712bb1ea2151944cf06a0e08c315c70c1e3 upstream.

    The stack object “info” in snd_opl3_ioctl() has a leaking problem.
    It has 2 padding bytes which are not initialized and leaked via
    “copy_to_user”.

    Signed-off-by: xidongwang <wangxidong_97@163.com>
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/1594006058-30362-1-git-send-email-wangxidong_97@163.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/drivers/opl3/opl3_synth.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/sound/drivers/opl3/opl3_synth.c
    +++ b/sound/drivers/opl3/opl3_synth.c
    @@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw
    {
    struct snd_dm_fm_info info;

    + memset(&info, 0, sizeof(info));
    +
    info.fm_mode = opl3->fm_mode;
    info.rhythm = opl3->rhythm;
    if (copy_to_user(argp, &info, sizeof(struct snd_dm_fm_info)))

    \
     
     \ /
      Last update: 2020-07-20 17:39    [W:4.058 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site