]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: cd40a2a) | patch
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
authorTakashi Iwai <tiwai@suse.de>
Sat, 10 Mar 2018 22:04:23 +0000 (23:04 +0100)
committerTakashi Iwai <tiwai@suse.de>
Sun, 11 Mar 2018 09:25:10 +0000 (10:25 +0100)
commit56b9879b32faaca1e238d94fbabe1a81ed399ed3
tree1b6bcb6a25c2c4d73eb9f3247f63c84216f6a9bbtree | snapshot
parentcd40a2a198475770abd7a9bef52b600569a85d18commit | diff
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()

snd_pcm_oss_get_formats() has an obvious use-after-free around
snd_mask_test() calls, as spotted by syzbot.  The passed format_mask
argument is a pointer to the hw_params object that is freed before the
loop.  What a surprise that it has been present since the original
code of decades ago...

Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/oss/pcm_oss.c diff | blob | history
Linux Kernel Source Tree.