forked from luck/tmp_suning_uos_patched
4cc8d6505a
syzkaller reported an invalid access in PCM OSS read, and this seems to be an overflow of the internal buffer allocated for a plugin. Since the rate plugin adjusts its transfer size dynamically, the calculation for the chained plugin might be bigger than the given buffer size in some extreme cases, which lead to such an buffer overflow as caught by KASAN. Fix it by limiting the max transfer size properly by checking against the destination size in each plugin transfer callback. Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| copy.c | ||
| io.c | ||
| linear.c | ||
| Makefile | ||
| mixer_oss.c | ||
| mulaw.c | ||
| pcm_oss.c | ||
| pcm_plugin.c | ||
| pcm_plugin.h | ||
| rate.c | ||
| route.c | ||