qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] ossaudio: fix out of bounds write


From: Philippe Mathieu-Daudé
Subject: Re: [PATCH] ossaudio: fix out of bounds write
Date: Wed, 8 Jul 2020 10:30:14 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0

On 7/7/20 8:08 PM, Volker Rümelin wrote:
> In function oss_read() a read error currently does not exit the
> read loop. With no data to read the variable pos will quickly
> underflow and a subsequent successful read overwrites memory
> outside the buffer. This patch adds the missing break statement
> to the error path of the function.

Correct, but ...

> 
> To reproduce start qemu with -audiodev oss,id=audio0 and in the
> guest start audio recording. After some time this will trigger
> an exception.
> 
> Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api"
> 
> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
> ---
>  audio/ossaudio.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/audio/ossaudio.c b/audio/ossaudio.c
> index f88d076ec2..a7dcaa31ad 100644
> --- a/audio/ossaudio.c
> +++ b/audio/ossaudio.c
> @@ -691,6 +691,7 @@ static size_t oss_read(HWVoiceIn *hw, void *buf, size_t 
> len)
>                             len, dst);
>                  break;
>              }
> +            break;
>          }
>  
>          pos += nread;

... now pos += -1, then the size returned misses the last byte.




reply via email to

[Prev in Thread] Current Thread [Next in Thread]