Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8c006aa authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: timer: Info leak in snd_timer_user_tinterrupt() 



The "r1" struct has memory holes.  We clear it with memset on one path
where it is used but not the other.  Let's just memset it at the start
of the function so it's always safe.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent e8ed6820

sound/core/timer.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -1277,6 +1277,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, 
	struct timespec tstamp;

	struct timespec tstamp;

	int prev, append = 0;

	int prev, append = 0;





	memset(&r1, 0, sizeof(r1));

	memset(&tstamp, 0, sizeof(tstamp));

	memset(&tstamp, 0, sizeof(tstamp));

	spin_lock(&tu->qlock);

	spin_lock(&tu->qlock);

	if ((tu->filter & ((1 << SNDRV_TIMER_EVENT_RESOLUTION) |

	if ((tu->filter & ((1 << SNDRV_TIMER_EVENT_RESOLUTION) |
@@ -1292,7 +1293,6 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, 
	}

	}

	if ((tu->filter & (1 << SNDRV_TIMER_EVENT_RESOLUTION)) &&

	if ((tu->filter & (1 << SNDRV_TIMER_EVENT_RESOLUTION)) &&

	    tu->last_resolution != resolution) {

	    tu->last_resolution != resolution) {

		memset(&r1, 0, sizeof(r1));

		r1.event = SNDRV_TIMER_EVENT_RESOLUTION;

		r1.event = SNDRV_TIMER_EVENT_RESOLUTION;

		r1.tstamp = tstamp;

		r1.tstamp = tstamp;

		r1.val = resolution;

		r1.val = resolution;