lkml.org 
[lkml]   [2021]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 02/58] ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
    Date
    From: Takashi Iwai <tiwai@suse.de>

    commit 217bfbb8b0bfa24619b11ab75c135fec99b99b20 upstream.

    snd_seq_oss_synth_make_info() didn't check the error code from
    snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy()
    with the uninitialized string as the source, which may lead to the
    access over the limit.

    Add the proper error check for avoiding the failure.

    Reported-by: syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/seq/oss/seq_oss_synth.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/sound/core/seq/oss/seq_oss_synth.c
    +++ b/sound/core/seq/oss/seq_oss_synth.c
    @@ -624,7 +624,8 @@ snd_seq_oss_synth_make_info(struct seq_o

    if (info->is_midi) {
    struct midi_info minf;
    - snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
    + if (snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf))
    + return -ENXIO;
    inf->synth_type = SYNTH_TYPE_MIDI;
    inf->synth_subtype = 0;
    inf->nr_voices = 16;

    \
     
     \ /
      Last update: 2021-01-26 09:23    [W:4.234 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site