Messages in this thread | | | Date | Fri, 29 Sep 2023 10:27:02 -0700 | From | Kees Cook <> | Subject | Re: [PATCH][next] ALSA: 6fire: Fix undefined behavior bug in struct midi_runtime |
| |
On Fri, Sep 29, 2023 at 06:06:32PM +0200, Gustavo A. R. Silva wrote: > `struct urb` is a flexible structure, which means that it contains a > flexible-array member at the bottom. This could potentially lead to an > overwrite of the objects following `out_urb` in `struct midi_runtime`, > among them a function pointer. > > Fix this by placing the declaration of object `out_urb` at the end of > `struct midi_runtime`. > > Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB") > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Another good find. :)
Reviewed-by: Kees Cook <keescook@chromium.org>
-- Kees Cook
| |