Commit 1c62e9f2 authored Apr 21, 2013 by Dan Carpenter Committed by Takashi Iwai Apr 22, 2013

ALSA: compress: info leak in snd_compr_get_caps()



If the ->get_caps() function doesn't clear the buffer then there would
stack information leaked to userspace.  For example,
soc_compr_get_caps() can return success without clearing the buffer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent f0283b58

sound/core/compress_offload.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -409,6 +409,7 @@ snd_compr_get_caps(struct snd_compr_stream *stream, unsigned long arg)
		if (!stream->ops->get_caps)
		return -ENXIO;

		memset(&caps, 0, sizeof(caps));
		retval = stream->ops->get_caps(stream, &caps);
		if (retval)
		goto out;