Google Git
Sign in
qemu / qemu / 725662d6dbfbbc536bb4006fbd93bcc6e82c8a34
commit725662d6dbfbbc536bb4006fbd93bcc6e82c8a34[log] [tgz]
authorKővágó, Zoltán <dirty.ice.hu@gmail.com>Mon Aug 26 21:59:01 2019 +0200
committerGerd Hoffmann <kraxel@redhat.com>Wed Aug 28 11:56:56 2019 +0200
tree24f70c9a6de4e249968733d861bfaa05f8e2b6d2
parent23919ddfd56135cad3cb468a8f54d5a595f024f4 [diff]
audio: fix invalid malloc size in audio_create_pdos

The code used sizeof(AudiodevAlsaPerDirectionOptions) instead of the
appropriate per direction options for the audio backend.  If the size of
the actual audiodev's per direction options are larger than alsa's, it
could cause a buffer overflow.

However, alsa has three fields in per direction options: a string, an
uint32 and a bool.  Oss has the same fields, coreaudio has a single
uint32, paaudio has a string and an uint32, all other backends only use
the common options, so currently no per direction options struct should
be larger than alsa's.

Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
Message-Id: <7808bc816ba7da8b8de8a214713444d85f7af3c6.1566847960.git.DirtY.iCE.hu@gmail.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
1 file changed
tree: 24f70c9a6de4e249968733d861bfaa05f8e2b6d2
  1. accel/
  2. audio/
  3. authz/
  4. backends/
  5. block/
  6. bsd-user/
  7. chardev/
  8. contrib/
  9. crypto/
  10. default-configs/
  11. disas/
  12. docs/
  13. dump/
  14. fpu/
  15. fsdev/
  16. gdb-xml/
  17. hw/
  18. include/
  19. io/
  20. libdecnumber/
  21. linux-headers/
  22. linux-user/
  23. migration/
  24. monitor/
  25. nbd/
  26. net/
  27. pc-bios/
  28. po/
  29. python/
  30. qapi/
  31. qga/
  32. qobject/
  33. qom/
  34. replay/
  35. roms/
  36. scripts/
  37. scsi/
  38. stubs/
  39. target/
  40. tcg/
  41. tests/
  42. trace/
  43. ui/
  44. util/
  45. capstone
  46. dtc
  47. slirp
  48. .cirrus.yml
  49. .dir-locals.el
  50. .editorconfig
  51. .exrc
  52. .gdbinit
  53. .gitignore
  54. .gitlab-ci.yml
  55. .gitmodules
  56. .gitpublish
  57. .mailmap
  58. .patchew.yml
  59. .shippable.yml
  60. .travis.yml
  61. arch_init.c
  62. balloon.c
  63. block.c
  64. blockdev-nbd.c
  65. blockdev.c
  66. blockjob.c
  67. bootdevice.c
  68. bt-host.c
  69. bt-vhci.c
  70. Changelog
  71. CODING_STYLE
  72. configure
  73. COPYING
  74. COPYING.LIB
  75. cpus-common.c
  76. cpus.c
  77. device-hotplug.c
  78. device_tree.c
  79. disas.c
  80. dma-helpers.c
  81. exec.c
  82. gdbstub.c
  83. gitdm.config
  84. HACKING
  85. hmp-commands-info.hx
  86. hmp-commands.hx
  87. ioport.c
  88. iothread.c
  89. job-qmp.c
  90. job.c
  91. Kconfig.host
  92. LICENSE
  93. MAINTAINERS
  94. Makefile
  95. Makefile.objs
  96. Makefile.target
  97. memory.c
  98. memory_ldst.inc.c
  99. memory_mapping.c
  100. module-common.c
  101. os-posix.c
  102. os-win32.c
  103. qdev-monitor.c
  104. qemu-bridge-helper.c
  105. qemu-deprecated.texi
  106. qemu-doc.texi
  107. qemu-edid.c
  108. qemu-ga.texi
  109. qemu-img-cmds.hx
  110. qemu-img.c
  111. qemu-img.texi
  112. qemu-io-cmds.c
  113. qemu-io.c
  114. qemu-keymap.c
  115. qemu-nbd.c
  116. qemu-nbd.texi
  117. qemu-option-trace.texi
  118. qemu-options-wrapper.h
  119. qemu-options.h
  120. qemu-options.hx
  121. qemu-seccomp.c
  122. qemu-tech.texi
  123. qemu.nsi
  124. qemu.sasl
  125. qtest.c
  126. README
  127. replication.c
  128. replication.h
  129. rules.mak
  130. thunk.c
  131. tpm.c
  132. trace-events
  133. VERSION
  134. version.rc
  135. vl.c