[ALSA - lib 0000675]: snd_output_buffer segfault

[bugtrack@alsa-project.org]

The following issue has been SUBMITTED.
======================================================================
<https://bugtrack.alsa-project.org/alsa-bug/view.php?id=675> 
======================================================================
Reported By:                schottstaedt
Assigned To:                
======================================================================
Project:                    ALSA - lib
Issue ID:                   675
Category:                   general
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     new
======================================================================
Date Submitted:             11-24-2004 15:00 CET
Last Modified:              11-24-2004 15:00 CET
======================================================================
Summary:                    snd_output_buffer segfault
Description: 
In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in
alsa-lib/src/output.c can write to memory it does not own,
causing segfaults in various unrelated later mallocs.  The
offending line is 280:

  result = vsnprintf(buffer->buf + buffer->size, size, format, args);

which should be:

  result = vsnprintf(buffer->buf + buffer->size, result, format, args);

There might not actually be "size" bytes available beyond
buffer->buf+buffer->size --
the preceding snd_output_buffer_need call only guaranteed "result" bytes.

Another similar bug reported by valgrind is in line 303:

	memcpy(buffer->buf + buffer->size, str, size);

where you actually have "err" bytes available, not "size".

And by the way, I really don't like this bug tracking
crap -- you should make it easy to report a bug.

======================================================================

Issue History
Date Modified  Username       Field                    Change              
======================================================================
11-24-04 15:00 schottstaedt   New Issue                                    
======================================================================




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/