[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] ossaudio: fix out of bounds write
From: |
Volker Rümelin |
Subject: |
[PATCH] ossaudio: fix out of bounds write |
Date: |
Tue, 7 Jul 2020 20:08:36 +0200 |
In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.
To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.
Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api"
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
---
audio/ossaudio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index f88d076ec2..a7dcaa31ad 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -691,6 +691,7 @@ static size_t oss_read(HWVoiceIn *hw, void *buf, size_t len)
len, dst);
break;
}
+ break;
}
pos += nread;
--
2.26.2
- [PATCH] ossaudio: fix out of bounds write,
Volker Rümelin <=