* [PATCH] pcm: fix buffer overflow in snd_pcm_chmap_print()
@ 2014-12-30 18:46 Anssi Hannula
2014-12-31 9:03 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Anssi Hannula @ 2014-12-30 18:46 UTC (permalink / raw)
To: Takashi Iwai; +Cc: alsa-devel
The size argument is wrong for one of the snprintf() calls in
snd_pcm_chmap_print(), allowing an overflow to happen (the user-provided
buffer may be written data up to 2x its actual size).
Seen in an user report here: http://trac.kodi.tv/ticket/15641
Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
---
src/pcm/pcm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
index baa47c7..e74e02f 100644
--- a/src/pcm/pcm.c
+++ b/src/pcm/pcm.c
@@ -7621,7 +7621,7 @@ int snd_pcm_chmap_print(const snd_pcm_chmap_t *map, size_t maxlen, char *buf)
return -ENOMEM;
}
if (map->pos[i] & SND_CHMAP_DRIVER_SPEC)
- len += snprintf(buf + len, maxlen, "%d", p);
+ len += snprintf(buf + len, maxlen - len, "%d", p);
else {
const char *name = chmap_names[p];
if (name)
--
1.8.4.5
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] pcm: fix buffer overflow in snd_pcm_chmap_print()
2014-12-30 18:46 [PATCH] pcm: fix buffer overflow in snd_pcm_chmap_print() Anssi Hannula
@ 2014-12-31 9:03 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2014-12-31 9:03 UTC (permalink / raw)
To: Anssi Hannula; +Cc: alsa-devel
At Tue, 30 Dec 2014 20:46:11 +0200,
Anssi Hannula wrote:
>
> The size argument is wrong for one of the snprintf() calls in
> snd_pcm_chmap_print(), allowing an overflow to happen (the user-provided
> buffer may be written data up to 2x its actual size).
>
> Seen in an user report here: http://trac.kodi.tv/ticket/15641
>
> Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Thanks, applied.
Takashi
> ---
> src/pcm/pcm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
> index baa47c7..e74e02f 100644
> --- a/src/pcm/pcm.c
> +++ b/src/pcm/pcm.c
> @@ -7621,7 +7621,7 @@ int snd_pcm_chmap_print(const snd_pcm_chmap_t *map, size_t maxlen, char *buf)
> return -ENOMEM;
> }
> if (map->pos[i] & SND_CHMAP_DRIVER_SPEC)
> - len += snprintf(buf + len, maxlen, "%d", p);
> + len += snprintf(buf + len, maxlen - len, "%d", p);
> else {
> const char *name = chmap_names[p];
> if (name)
> --
> 1.8.4.5
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-12-31 9:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-30 18:46 [PATCH] pcm: fix buffer overflow in snd_pcm_chmap_print() Anssi Hannula
2014-12-31 9:03 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox