This is a note to let you know that I've just added the patch titled
ALSA: core: fix buffer overflow in snd_info_get_line()
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
alsa-core-fix-buffer-overflow-in-snd_info_get_line.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ddc64b278a4dda052390b3de1b551e59acdff105 Mon Sep 17 00:00:00 2001
From: Clemens Ladisch <clemens@xxxxxxxxxx>
Date: Thu, 21 Aug 2014 20:55:21 +0200
Subject: ALSA: core: fix buffer overflow in snd_info_get_line()
From: Clemens Ladisch <clemens@xxxxxxxxxx>
commit ddc64b278a4dda052390b3de1b551e59acdff105 upstream.
snd_info_get_line() documents that its last parameter must be one
less than the buffer size, but this API design guarantees that
(literally) every caller gets it wrong.
Just change this parameter to have its obvious meaning.
Reported-by: Tommi Rantala <tt.rantala@xxxxxxxxx>
Signed-off-by: Clemens Ladisch <clemens@xxxxxxxxxx>
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
sound/core/info.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -679,7 +679,7 @@ int snd_info_card_free(struct snd_card *
* snd_info_get_line - read one line from the procfs buffer
* @buffer: the procfs buffer
* @line: the buffer to store
- * @len: the max. buffer size - 1
+ * @len: the max. buffer size
*
* Reads one line from the buffer and stores the string.
*
@@ -699,7 +699,7 @@ int snd_info_get_line(struct snd_info_bu
buffer->stop = 1;
if (c == '\n')
break;
- if (len) {
+ if (len > 1) {
len--;
*line++ = c;
}
Patches currently in stable-queue which might be from clemens@xxxxxxxxxx are
queue-3.10/alsa-core-fix-buffer-overflow-in-snd_info_get_line.patch
queue-3.10/alsa-pcm-fix-fifo_size-frame-calculation.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html