forked from luck/tmp_suning_uos_patched
ff654f1d31
commit 175b8d89fe292796811fdee87fa39799a5b6b87a upstream. syzbot spotted a potential out-of-bounds shift in the PCM OSS layer where it calculates the buffer size with the arbitrary shift value given via an ioctl. Add a range check for avoiding the undefined behavior. As the value can be treated by a signed integer, the max shift should be 30. Reported-by: syzbot+df7dc146ebdd6435eea3@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20201209084552.17109-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
copy.c | ||
io.c | ||
linear.c | ||
Makefile | ||
mixer_oss.c | ||
mulaw.c | ||
pcm_oss.c | ||
pcm_plugin.c | ||
pcm_plugin.h | ||
rate.c | ||
route.c |