Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0c7be5b authored by Takashi Iwai's avatar Takashi Iwai Committed by Greg Kroah-Hartman
Browse files

ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() 



commit 217bfbb8b0bfa24619b11ab75c135fec99b99b20 upstream.

snd_seq_oss_synth_make_info() didn't check the error code from
snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy()
with the uninitialized string as the source, which may lead to the
access over the limit.

Add the proper error check for avoiding the failure.

Reported-by: default avatar <syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9de43ead

sound/core/seq/oss/seq_oss_synth.c

+2 −1
Original line number Diff line number Diff line
@@ -624,7 +624,8 @@ snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_in 


	if (info->is_midi) {

		struct midi_info minf;

		snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);

		if (snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf))

			return -ENXIO;

		inf->synth_type = SYNTH_TYPE_MIDI;

		inf->synth_subtype = 0;

		inf->nr_voices = 16;