On Fri, 23 Sep 2016 18:11:16 +0200,
Antonio Ospite wrote:
>
> When calling snd_use_case_geti(uc_mgr, "_devstatus", &lvalue) the code
> ends up calling device_status(uc_mgr, NULL), which result in a crash in
> strcmp(dev->name, NULL), when there are enabled devices.
>
> This happens because snd_use_case_geti() allows a "_devstatus"
> identifier even if it's only supposed to allow the form
> "_devstatus/{device}".
>
> So check that the device name is not null.
>
> The same issue occurs with "_modstatus", this change fixes that as well.
>
> Signed-off-by: Antonio Ospite <ao2@xxxxxx>
> ---
>
> Hi,
>
> the bug can be reproduced with a command like this:
>
> # alsaucm -n -b - <<EOM
> open bytcr-rt5640
> reset
> set _verb HiFi
> set _device Speaker
> geti _devstatus
> EOM
> Segmentation fault
>
> I decided to add the check once per command instead of doing this:
>
> @@ -1525,7 +1525,8 @@ int snd_use_case_geti(snd_use_case_mgr_t *uc_mgr,
> goto __end;
> }
> } else {
> - str = NULL;
> + err = -EINVAL;
> + goto __end;
> }
>
> because the function body seems to be prepared to accept other forms of
> identifiers, possibly even without a "prefix/suffix" structure.
OK, applied now.
>
> Ciao ciao,
> Antonio
>
> P.S. the source code in src/ucm has a mixed indentation style of TABs and
> spaces, would you accept a patch to uniform the style?
I don't mind either, leaving or fixing :)
thanks,
Takashi
>
> src/ucm/main.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/src/ucm/main.c b/src/ucm/main.c
> index 24d9510..d5e418e 100644
> --- a/src/ucm/main.c
> +++ b/src/ucm/main.c
> @@ -1528,12 +1528,20 @@ int snd_use_case_geti(snd_use_case_mgr_t *uc_mgr,
> str = NULL;
> }
> if (check_identifier(identifier, "_devstatus")) {
> + if(!str) {
> + err = -EINVAL;
> + goto __end;
> + }
> err = device_status(uc_mgr, str);
> if (err >= 0) {
> *value = err;
> err = 0;
> }
> } else if (check_identifier(identifier, "_modstatus")) {
> + if(!str) {
> + err = -EINVAL;
> + goto __end;
> + }
> err = modifier_status(uc_mgr, str);
> if (err >= 0) {
> *value = err;
> --
> 2.9.3
>
_______________________________________________
Alsa-devel mailing list
Alsa-devel@xxxxxxxxxxxxxxxx
http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
