From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl() Date: Thu, 7 Nov 2013 11:09:54 +0300 Message-ID: <20131107080954.GS21844@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by alsa0.perex.cz (Postfix) with ESMTP id 1D86F2610A8 for ; Thu, 7 Nov 2013 09:10:05 +0100 (CET) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org To: Takashi Iwai Cc: alsa-devel@alsa-project.org, kernel-janitors@vger.kernel.org List-Id: alsa-devel@alsa-project.org There is a 2 byte hole after "info.func_nr" so we could leak unitialized stack information to userspace. Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2') Signed-off-by: Dan Carpenter diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c index c1aa21e..48da227 100644 --- a/sound/isa/sb/sb16_csp.c +++ b/sound/isa/sb/sb16_csp.c @@ -208,6 +208,7 @@ static int snd_sb_csp_ioctl(struct snd_hwdep * hw, struct file *file, unsigned i switch (cmd) { /* get information */ case SNDRV_SB_CSP_IOCTL_INFO: + memset(&info, 0, sizeof(info)); *info.codec_name = *p->codec_name; info.func_nr = p->func_nr; info.acc_format = p->acc_format; From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Thu, 07 Nov 2013 08:09:54 +0000 Subject: [patch] [ALSA] sb16 - info leak in snd_sb_csp_ioctl() Message-Id: <20131107080954.GS21844@elgon.mountain> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Takashi Iwai Cc: alsa-devel@alsa-project.org, kernel-janitors@vger.kernel.org There is a 2 byte hole after "info.func_nr" so we could leak unitialized stack information to userspace. Fixes: 1da177e4c3f4 ('Linux-2.6.12-rc2') Signed-off-by: Dan Carpenter diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c index c1aa21e..48da227 100644 --- a/sound/isa/sb/sb16_csp.c +++ b/sound/isa/sb/sb16_csp.c @@ -208,6 +208,7 @@ static int snd_sb_csp_ioctl(struct snd_hwdep * hw, struct file *file, unsigned i switch (cmd) { /* get information */ case SNDRV_SB_CSP_IOCTL_INFO: + memset(&info, 0, sizeof(info)); *info.codec_name = *p->codec_name; info.func_nr = p->func_nr; info.acc_format = p->acc_format;