From: GitHub pull_request - opened <github@alsa-project.org>
To: alsa-devel@alsa-project.org
Subject: topology: decoder: fix wrong sizeof for enum control allocation in dapm
Date: Mon, 23 Mar 2026 16:16:14 +0100 (CET) [thread overview]
Message-ID: <189f8152ff72eb00-webhooks-bot@alsa-project.org> (raw)
In-Reply-To: <alsa-project/alsa-lib/pr/501@alsa-project.org>
alsa-project/alsa-lib pull request #501 was opened from kv2019i:
The tplg_calloc() call for enum control in the dapm widget kcontrol decode loop used sizeof(*mt) (mixer template) instead of sizeof(*et) (enum template). On 64-bit systems, snd_tplg_mixer_template is 72 bytes while snd_tplg_enum_template is 80 bytes, causing an 8-byte heap buffer overflow when the enum fields (texts, values pointers) were written past the allocated block. This resulted in heap corruption and e.g. glibc malloc hit an assert.
Request URL : https://github.com/alsa-project/alsa-lib/pull/501
Patch URL : https://github.com/alsa-project/alsa-lib/pull/501.patch
Repository URL: https://github.com/alsa-project/alsa-lib
parent reply other threads:[~2026-03-23 15:16 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <alsa-project/alsa-lib/pr/501@alsa-project.org>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=189f8152ff72eb00-webhooks-bot@alsa-project.org \
--to=github@alsa-project.org \
--cc=alsa-devel@alsa-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox