Skip to content

Commit

Permalink
ALSA: hdspm - potential info leak in snd_hdspm_hwdep_ioctl()
Browse files Browse the repository at this point in the history
Smatch has a new check for Rosenberg type information leaks where
structs are copied to the user with uninitialized stack data in them.

The status struct has a hole in it, and on some paths not all the
members were initialized.

struct hdspm_status {
        unsigned char              card_type;            /*     0     1 */
        /* XXX 3 bytes hole, try to pack */
        enum hdspm_syncsource      autosync_source;      /*     4     4 */
        long long unsigned int     card_clock;           /*     8     8 */

The hdspm_version struct had holes in it as well.

struct hdspm_version {
        unsigned char              card_type;            /*     0     1 */
        char                       cardname[20];         /*     1    20 */
        /* XXX 3 bytes hole, try to pack */
        unsigned int               serial;               /*    24     4 */
        short unsigned int         firmware_rev;         /*    28     2 */
        /* XXX 2 bytes hole, try to pack */
        int                        addons;               /*    32     4 */

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Dan Carpenter authored and Takashi Iwai committed Sep 23, 2011
1 parent 8e699d2 commit 643d6bb
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions sound/pci/rme9652/hdspm.c
Original file line number Diff line number Diff line change
Expand Up @@ -6227,6 +6227,8 @@ static int snd_hdspm_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
break;

case SNDRV_HDSPM_IOCTL_GET_STATUS:
memset(&status, 0, sizeof(status));

status.card_type = hdspm->io_type;

status.autosync_source = hdspm_autosync_ref(hdspm);
Expand Down Expand Up @@ -6266,6 +6268,8 @@ static int snd_hdspm_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
break;

case SNDRV_HDSPM_IOCTL_GET_VERSION:
memset(&hdspm_version, 0, sizeof(hdspm_version));

hdspm_version.card_type = hdspm->io_type;
strncpy(hdspm_version.cardname, hdspm->card_name,
sizeof(hdspm_version.cardname));
Expand Down

0 comments on commit 643d6bb

Please sign in to comment.