diff options
| author | Hui Peng <[email protected]> | 2019-08-15 04:31:34 +0000 |
|---|---|---|
| committer | Takashi Iwai <[email protected]> | 2019-08-15 19:48:52 +0000 |
| commit | 19bce474c45be69a284ecee660aa12d8f1e88f18 (patch) | |
| tree | 9a58decee9c325aa1dc879780b3bc778d6793e36 /scripts/gen_compile_commands.py | |
| parent | ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit (diff) | |
| download | kernel-19bce474c45be69a284ecee660aa12d8f1e88f18.tar.gz kernel-19bce474c45be69a284ecee660aa12d8f1e88f18.zip | |
ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
`check_input_term` recursively calls itself with input from
device side (e.g., uac_input_terminal_descriptor.bCSourceID)
as argument (id). In `check_input_term`, if `check_input_term`
is called with the same `id` argument as the caller, it triggers
endless recursive call, resulting kernel space stack overflow.
This patch fixes the bug by adding a bitmap to `struct mixer_build`
to keep track of the checked ids and stop the execution if some id
has been checked (similar to how parse_audio_unit handles unitid
argument).
Reported-by: Hui Peng <[email protected]>
Reported-by: Mathias Payer <[email protected]>
Signed-off-by: Hui Peng <[email protected]>
Cc: <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Diffstat (limited to 'scripts/gen_compile_commands.py')
0 files changed, 0 insertions, 0 deletions