[ALSA - lib 0000675]: snd_output_buffer segfault

[bugtrack@alsa-project.org]

The following issue has been RESOLVED.
======================================================================
<https://bugtrack.alsa-project.org/alsa-bug/view.php?id=675> 
======================================================================
Reported By:                schottstaedt
Assigned To:                Clemens Ladisch
======================================================================
Project:                    ALSA - lib
Issue ID:                   675
Category:                   general
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     resolved
Resolution:                 fixed
Fixed in Version:           
======================================================================
Date Submitted:             11-24-2004 15:00 CET
Last Modified:              11-24-2004 17:35 CET
======================================================================
Summary:                    snd_output_buffer segfault
Description: 
In Alsa 1.0.6 (and 1.0.7 I think), snd_output_buffer_puts in
alsa-lib/src/output.c can write to memory it does not own,
causing segfaults in various unrelated later mallocs.  The
offending line is 280:

  result = vsnprintf(buffer->buf + buffer->size, size, format, args);

which should be:

  result = vsnprintf(buffer->buf + buffer->size, result, format, args);

There might not actually be "size" bytes available beyond
buffer->buf+buffer->size --
the preceding snd_output_buffer_need call only guaranteed "result" bytes.

Another similar bug reported by valgrind is in line 303:

	memcpy(buffer->buf + buffer->size, str, size);

where you actually have "err" bytes available, not "size".

And by the way, I really don't like this bug tracking
crap -- you should make it easy to report a bug.

======================================================================

----------------------------------------------------------------------
 Clemens Ladisch - 11-24-04 17:35 
----------------------------------------------------------------------
The snd_output_buffer_need() function should have guaranteed that at least
'size' bytes are available.

Now fixed in CVS with the patch below:

--- alsa-lib/src/output.c	20 Jul 2004 15:36:08 -0000	1.21
+++ alsa-lib/src/output.c	24 Nov 2004 16:31:56 -0000	1.22
@@ -258,7 +258,7 @@
 		alloc = 256;
 	else
 		alloc = buffer->alloc;
-	while (alloc < size)
+	while (alloc < buffer->size + size)
 		alloc *= 2;
 	buf = realloc(buffer->buf, alloc);
 	if (!buf)

Issue History
Date Modified  Username       Field                    Change              
======================================================================
11-24-04 15:00 schottstaedt   New Issue                                    
11-24-04 17:32 Clemens LadischStatus                   new => assigned     
11-24-04 17:32 Clemens LadischAssigned To               => Clemens Ladisch 
11-24-04 17:35 Clemens LadischStatus                   assigned => resolved
11-24-04 17:35 Clemens LadischResolution               open => fixed       
11-24-04 17:35 Clemens LadischNote Added: 0002572                          
======================================================================




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/