Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14dfd826 authored by Kangjie Lu's avatar Kangjie Lu Committed by Mark Salyzyn
Browse files

UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS 



(cherry pick from commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e)

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: default avatarKangjie Lu <kjlu@gatech.edu>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Bug: 28980557
Change-Id: Ibda2d126f6d72fedf797a98796c3cde7bb03db76
parent b40d9bca

sound/core/timer.c

+1 −0
Original line number Diff line number Diff line
@@ -1680,6 +1680,7 @@ static int snd_timer_user_params(struct file *file, 
	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {

		if (tu->tread) {

			struct snd_timer_tread tread;

			memset(&tread, 0, sizeof(tread));

			tread.event = SNDRV_TIMER_EVENT_EARLY;

			tread.tstamp.tv_sec = 0;

			tread.tstamp.tv_nsec = 0;