From patchwork Tue Jul 7 18:08:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Volker_R=C3=BCmelin?= X-Patchwork-Id: 11649521 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E9D2113B4 for ; Tue, 7 Jul 2020 18:09:14 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CA2DD20708 for ; Tue, 7 Jul 2020 18:09:14 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CA2DD20708 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=t-online.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Received: from localhost ([::1]:35732 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jss1q-0005yk-3q for patchwork-qemu-devel@patchwork.kernel.org; Tue, 07 Jul 2020 14:09:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:33552) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jss1P-0005Zr-99 for qemu-devel@nongnu.org; Tue, 07 Jul 2020 14:08:47 -0400 Received: from mailout08.t-online.de ([194.25.134.20]:43082) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jss1N-0001eJ-H3 for qemu-devel@nongnu.org; Tue, 07 Jul 2020 14:08:47 -0400 Received: from fwd29.aul.t-online.de (fwd29.aul.t-online.de [172.20.26.134]) by mailout08.t-online.de (Postfix) with SMTP id 934294146F6A; Tue, 7 Jul 2020 20:08:40 +0200 (CEST) Received: from linpower.localnet (JO3gSYZLYhGU3ycmzqNn4SBhNo6i3PSdPkXASKhE7CXM2K4VvLBgk6GJ2FVODARQJu@[93.236.146.213]) by fwd29.t-online.de with (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384 encrypted) esmtp id 1jss1E-14IzAG0; Tue, 7 Jul 2020 20:08:36 +0200 Received: by linpower.localnet (Postfix, from userid 1000) id 5317621B1CD; Tue, 7 Jul 2020 20:08:36 +0200 (CEST) From: =?utf-8?q?Volker_R=C3=BCmelin?= To: Gerd Hoffmann Subject: [PATCH] ossaudio: fix out of bounds write Date: Tue, 7 Jul 2020 20:08:36 +0200 Message-Id: <20200707180836.5435-1-vr_qemu@t-online.de> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-ID: JO3gSYZLYhGU3ycmzqNn4SBhNo6i3PSdPkXASKhE7CXM2K4VvLBgk6GJ2FVODARQJu X-TOI-EXPURGATEID: 150726::1594145316-0000FF93-F601CEB1/0/0 CLEAN NORMAL X-TOI-MSGID: fe4dfb67-5807-4782-86be-9fb3d12ae6c5 Received-SPF: none client-ip=194.25.134.20; envelope-from=volker.ruemelin@t-online.de; helo=mailout08.t-online.de X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/07 14:08:41 X-ACL-Warn: Detected OS = Linux 3.11 and newer [fuzzy] X-Spam_score_int: -8 X-Spam_score: -0.9 X-Spam_bar: / X-Spam_report: (-0.9 / 5.0 requ) BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, SPOOFED_FREEMAIL=1 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: QEMU , =?utf-8?b?Wm9sdMOhbiBLxZF2w6Fnw7M=?= Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" In function oss_read() a read error currently does not exit the read loop. With no data to read the variable pos will quickly underflow and a subsequent successful read overwrites memory outside the buffer. This patch adds the missing break statement to the error path of the function. To reproduce start qemu with -audiodev oss,id=audio0 and in the guest start audio recording. After some time this will trigger an exception. Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api" Signed-off-by: Volker Rümelin --- audio/ossaudio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/audio/ossaudio.c b/audio/ossaudio.c index f88d076ec2..a7dcaa31ad 100644 --- a/audio/ossaudio.c +++ b/audio/ossaudio.c @@ -691,6 +691,7 @@ static size_t oss_read(HWVoiceIn *hw, void *buf, size_t len) len, dst); break; } + break; } pos += nread;