* [ALSA - lib 0000675]: snd_output_buffer segfault
@ 2004-11-24 14:00 bugtrack
0 siblings, 0 replies; 4+ messages in thread
From: bugtrack @ 2004-11-24 14:00 UTC (permalink / raw)
To: alsa-devel
The following issue has been SUBMITTED.
======================================================================
<https://bugtrack.alsa-project.org/alsa-bug/view.php?id=675>
======================================================================
Reported By: schottstaedt
Assigned To:
======================================================================
Project: ALSA - lib
Issue ID: 675
Category: general
Reproducibility: always
Severity: major
Priority: normal
Status: new
======================================================================
Date Submitted: 11-24-2004 15:00 CET
Last Modified: 11-24-2004 15:00 CET
======================================================================
Summary: snd_output_buffer segfault
Description:
In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in
alsa-lib/src/output.c can write to memory it does not own,
causing segfaults in various unrelated later mallocs. The
offending line is 280:
result = vsnprintf(buffer->buf + buffer->size, size, format, args);
which should be:
result = vsnprintf(buffer->buf + buffer->size, result, format, args);
There might not actually be "size" bytes available beyond
buffer->buf+buffer->size --
the preceding snd_output_buffer_need call only guaranteed "result" bytes.
Another similar bug reported by valgrind is in line 303:
memcpy(buffer->buf + buffer->size, str, size);
where you actually have "err" bytes available, not "size".
And by the way, I really don't like this bug tracking
crap -- you should make it easy to report a bug.
======================================================================
Issue History
Date Modified Username Field Change
======================================================================
11-24-04 15:00 schottstaedt New Issue
======================================================================
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
^ permalink raw reply [flat|nested] 4+ messages in thread
* [ALSA - lib 0000675]: snd_output_buffer segfault
@ 2004-11-24 16:32 bugtrack
0 siblings, 0 replies; 4+ messages in thread
From: bugtrack @ 2004-11-24 16:32 UTC (permalink / raw)
To: alsa-devel
The following issue has been ASSIGNED.
======================================================================
<https://bugtrack.alsa-project.org/alsa-bug/view.php?id=675>
======================================================================
Reported By: schottstaedt
Assigned To: Clemens Ladisch
======================================================================
Project: ALSA - lib
Issue ID: 675
Category: general
Reproducibility: always
Severity: major
Priority: normal
Status: assigned
======================================================================
Date Submitted: 11-24-2004 15:00 CET
Last Modified: 11-24-2004 17:32 CET
======================================================================
Summary: snd_output_buffer segfault
Description:
In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in
alsa-lib/src/output.c can write to memory it does not own,
causing segfaults in various unrelated later mallocs. The
offending line is 280:
result = vsnprintf(buffer->buf + buffer->size, size, format, args);
which should be:
result = vsnprintf(buffer->buf + buffer->size, result, format, args);
There might not actually be "size" bytes available beyond
buffer->buf+buffer->size --
the preceding snd_output_buffer_need call only guaranteed "result" bytes.
Another similar bug reported by valgrind is in line 303:
memcpy(buffer->buf + buffer->size, str, size);
where you actually have "err" bytes available, not "size".
And by the way, I really don't like this bug tracking
crap -- you should make it easy to report a bug.
======================================================================
Issue History
Date Modified Username Field Change
======================================================================
11-24-04 15:00 schottstaedt New Issue
11-24-04 17:32 Clemens LadischStatus new => assigned
11-24-04 17:32 Clemens LadischAssigned To => Clemens Ladisch
======================================================================
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
^ permalink raw reply [flat|nested] 4+ messages in thread
* [ALSA - lib 0000675]: snd_output_buffer segfault
@ 2004-11-24 16:35 bugtrack
0 siblings, 0 replies; 4+ messages in thread
From: bugtrack @ 2004-11-24 16:35 UTC (permalink / raw)
To: alsa-devel
The following issue has been RESOLVED.
======================================================================
<https://bugtrack.alsa-project.org/alsa-bug/view.php?id=675>
======================================================================
Reported By: schottstaedt
Assigned To: Clemens Ladisch
======================================================================
Project: ALSA - lib
Issue ID: 675
Category: general
Reproducibility: always
Severity: major
Priority: normal
Status: resolved
Resolution: fixed
Fixed in Version:
======================================================================
Date Submitted: 11-24-2004 15:00 CET
Last Modified: 11-24-2004 17:35 CET
======================================================================
Summary: snd_output_buffer segfault
Description:
In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in
alsa-lib/src/output.c can write to memory it does not own,
causing segfaults in various unrelated later mallocs. The
offending line is 280:
result = vsnprintf(buffer->buf + buffer->size, size, format, args);
which should be:
result = vsnprintf(buffer->buf + buffer->size, result, format, args);
There might not actually be "size" bytes available beyond
buffer->buf+buffer->size --
the preceding snd_output_buffer_need call only guaranteed "result" bytes.
Another similar bug reported by valgrind is in line 303:
memcpy(buffer->buf + buffer->size, str, size);
where you actually have "err" bytes available, not "size".
And by the way, I really don't like this bug tracking
crap -- you should make it easy to report a bug.
======================================================================
----------------------------------------------------------------------
Clemens Ladisch - 11-24-04 17:35
----------------------------------------------------------------------
The snd_output_buffer_need() function should have guaranteed that at least
'size' bytes are available.
Now fixed in CVS with the patch below:
--- alsa-lib/src/output.c 20 Jul 2004 15:36:08 -0000 1.21
+++ alsa-lib/src/output.c 24 Nov 2004 16:31:56 -0000 1.22
@@ -258,7 +258,7 @@
alloc = 256;
else
alloc = buffer->alloc;
- while (alloc < size)
+ while (alloc < buffer->size + size)
alloc *= 2;
buf = realloc(buffer->buf, alloc);
if (!buf)
Issue History
Date Modified Username Field Change
======================================================================
11-24-04 15:00 schottstaedt New Issue
11-24-04 17:32 Clemens LadischStatus new => assigned
11-24-04 17:32 Clemens LadischAssigned To => Clemens Ladisch
11-24-04 17:35 Clemens LadischStatus assigned => resolved
11-24-04 17:35 Clemens LadischResolution open => fixed
11-24-04 17:35 Clemens LadischNote Added: 0002572
======================================================================
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
^ permalink raw reply [flat|nested] 4+ messages in thread
* [ALSA - lib 0000675]: snd_output_buffer segfault
@ 2004-12-27 14:50 bugtrack
0 siblings, 0 replies; 4+ messages in thread
From: bugtrack @ 2004-12-27 14:50 UTC (permalink / raw)
To: alsa-devel
The following issue has been CLOSED
======================================================================
<https://bugtrack.alsa-project.org/alsa-bug/view.php?id=675>
======================================================================
Reported By: schottstaedt
Assigned To: Clemens Ladisch
======================================================================
Project: ALSA - lib
Issue ID: 675
Category: general
Reproducibility: always
Severity: major
Priority: normal
Status: closed
Resolution: fixed
Fixed in Version:
======================================================================
Date Submitted: 11-24-2004 15:00 CET
Last Modified: 12-27-2004 15:50 CET
======================================================================
Summary: snd_output_buffer segfault
Description:
In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in
alsa-lib/src/output.c can write to memory it does not own,
causing segfaults in various unrelated later mallocs. The
offending line is 280:
result = vsnprintf(buffer->buf + buffer->size, size, format, args);
which should be:
result = vsnprintf(buffer->buf + buffer->size, result, format, args);
There might not actually be "size" bytes available beyond
buffer->buf+buffer->size --
the preceding snd_output_buffer_need call only guaranteed "result" bytes.
Another similar bug reported by valgrind is in line 303:
memcpy(buffer->buf + buffer->size, str, size);
where you actually have "err" bytes available, not "size".
And by the way, I really don't like this bug tracking
crap -- you should make it easy to report a bug.
======================================================================
----------------------------------------------------------------------
Clemens Ladisch - 11-24-04 17:35
----------------------------------------------------------------------
The snd_output_buffer_need() function should have guaranteed that at least
'size' bytes are available.
Now fixed in CVS with the patch below:
--- alsa-lib/src/output.c 20 Jul 2004 15:36:08 -0000 1.21
+++ alsa-lib/src/output.c 24 Nov 2004 16:31:56 -0000 1.22
@@ -258,7 +258,7 @@
alloc = 256;
else
alloc = buffer->alloc;
- while (alloc < size)
+ while (alloc < buffer->size + size)
alloc *= 2;
buf = realloc(buffer->buf, alloc);
if (!buf)
Issue History
Date Modified Username Field Change
======================================================================
11-24-04 15:00 schottstaedt New Issue
11-24-04 17:32 Clemens LadischStatus new => assigned
11-24-04 17:32 Clemens LadischAssigned To => Clemens Ladisch
11-24-04 17:35 Clemens LadischStatus assigned => resolved
11-24-04 17:35 Clemens LadischResolution open => fixed
11-24-04 17:35 Clemens LadischNote Added: 0002572
12-27-04 15:50 tiwai Status resolved => closed
======================================================================
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2004-12-27 14:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-11-24 16:32 [ALSA - lib 0000675]: snd_output_buffer segfault bugtrack
-- strict thread matches above, loose matches on Subject: below --
2004-12-27 14:50 bugtrack
2004-11-24 16:35 bugtrack
2004-11-24 14:00 bugtrack
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox