From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugtrack@alsa-project.org Subject: [ALSA - lib 0000675]: snd_output_buffer segfault Date: Wed, 24 Nov 2004 17:32:38 +0100 Message-ID: <9df4cc7505f9b7fa463087be910dbe37@bugtrack.alsa-project.org> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Received: from bugtrack.alsa-project.org (gate.perex.cz [82.113.61.162]) by alsa.alsa-project.org (ALSA's E-mail Delivery System) with ESMTP id 465151A4 for ; Wed, 24 Nov 2004 17:32:38 +0100 (MET) Sender: alsa-devel-admin@lists.sourceforge.net Errors-To: alsa-devel-admin@lists.sourceforge.net List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , List-Archive: To: alsa-devel@alsa-project.org List-Id: alsa-devel@alsa-project.org The following issue has been ASSIGNED. ====================================================================== ====================================================================== Reported By: schottstaedt Assigned To: Clemens Ladisch ====================================================================== Project: ALSA - lib Issue ID: 675 Category: general Reproducibility: always Severity: major Priority: normal Status: assigned ====================================================================== Date Submitted: 11-24-2004 15:00 CET Last Modified: 11-24-2004 17:32 CET ====================================================================== Summary: snd_output_buffer segfault Description: In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in alsa-lib/src/output.c can write to memory it does not own, causing segfaults in various unrelated later mallocs. The offending line is 280: result = vsnprintf(buffer->buf + buffer->size, size, format, args); which should be: result = vsnprintf(buffer->buf + buffer->size, result, format, args); There might not actually be "size" bytes available beyond buffer->buf+buffer->size -- the preceding snd_output_buffer_need call only guaranteed "result" bytes. Another similar bug reported by valgrind is in line 303: memcpy(buffer->buf + buffer->size, str, size); where you actually have "err" bytes available, not "size". And by the way, I really don't like this bug tracking crap -- you should make it easy to report a bug. ====================================================================== Issue History Date Modified Username Field Change ====================================================================== 11-24-04 15:00 schottstaedt New Issue 11-24-04 17:32 Clemens LadischStatus new => assigned 11-24-04 17:32 Clemens LadischAssigned To => Clemens Ladisch ====================================================================== ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/