Skip to contentSkip to conversation

ALSA: hdsp - info leak in snd_hdsp_hwdep_ioctl()

PATCH Applied Dan Carpenter 2 participants 2 messages Oct 16, 2013

Subsystems (2)
Sound Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ALSA: hdsp - info leak in snd_hdsp_hwdep_ioctl()

In GCC the sizeof(hdsp_version) is 8 because there is a 2 byte hole at the end of the struct after ->firmware_rev.

Signed-off-by Dan Carpenter <[email protected]>
sound/pci/rme9652/hdsp.c +1 -0
index 4f255df..f59a321 100644
@@ -4845,6 +4845,7 @@ static int snd_hdsp_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, unsigne
 			if ((err = hdsp_get_iobox_version(hdsp)) < 0)
 				return err;
 		}
+		memset(&hdsp_version, 0, sizeof(hdsp_version));
 		hdsp_version.io_type = hdsp->io_type;
 		hdsp_version.firmware_rev = hdsp->firmware_rev;
 		if ((err = copy_to_user(argp, &hdsp_version, sizeof(hdsp_version))))
Applied
#1 lore raw

At Wed, 16 Oct 2013 11:44:25 +0300,

Quoted 5 lines · Dan Carpenter

In GCC the sizeof(hdsp_version) is 8 because there is a 2 byte hole at the end of the struct after ->firmware_rev.

Signed-off-by Dan Carpenter <[email protected]>

Thanks, applied.

Takashi

Quoted 14 lines
sound/pci/rme9652/hdsp.c +1 -0
index 4f255df..f59a321 100644
@@ -4845,6 +4845,7 @@ static int snd_hdsp_hwdep_ioctl(struct snd_hwdep *hw, struct file *file, unsigne
 			if ((err = hdsp_get_iobox_version(hdsp)) < 0)
 				return err;
 		}
+		memset(&hdsp_version, 0, sizeof(hdsp_version));
 		hdsp_version.io_type = hdsp->io_type;
 		hdsp_version.firmware_rev = hdsp->firmware_rev;
 		if ((err = copy_to_user(argp, &hdsp_version, sizeof(hdsp_version))))