[PULL,1/4] ossaudio: fix out of bounds write
diff mbox series

Message ID 20200713141049.2241-2-kraxel@redhat.com
State New
Headers show
  • [PULL,1/4] ossaudio: fix out of bounds write
Related show

Commit Message

Gerd Hoffmann July 13, 2020, 2:10 p.m. UTC
From: Volker RĂ¼melin <vr_qemu@t-online.de>

In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.

To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.

Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api"

Signed-off-by: Volker RĂ¼melin <vr_qemu@t-online.de>
Message-id: 20200707180836.5435-1-vr_qemu@t-online.de
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 audio/ossaudio.c | 1 +
 1 file changed, 1 insertion(+)

diff mbox series

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index f88d076ec236..a7dcaa31adeb 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -691,6 +691,7 @@  static size_t oss_read(HWVoiceIn *hw, void *buf, size_t len)
                            len, dst);
+            break;
         pos += nread;