Commit bbcf19d3 authored May 03, 2016 by Kangjie Lu Committed by Greg Kroah-Hartman May 20, 2017

ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS



commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e upstream.

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 19f60979

sound/core/timer.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1759,6 +1759,7 @@ static int snd_timer_user_params(struct file *file,
	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {		if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {
	if (tu->tread) {		if (tu->tread) {
	struct snd_timer_tread tread;		struct snd_timer_tread tread;
			memset(&tread, 0, sizeof(tread));
	tread.event = SNDRV_TIMER_EVENT_EARLY;		tread.event = SNDRV_TIMER_EVENT_EARLY;
	tread.tstamp.tv_sec = 0;		tread.tstamp.tv_sec = 0;
	tread.tstamp.tv_nsec = 0;		tread.tstamp.tv_nsec = 0;