BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 05:31:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

ASoC: hdmi-codec: Fix OOB memory accesses

Browse Source 
Correct size of iec_status array by changing it to the size of status
array of the struct snd_aes_iec958. This fixes out-of-bounds slab
read accesses made by memcpy() of the hdmi-codec driver. This problem
is reported by KASAN.

Cc: [email protected]
Signed-off-by: Dmitry Osipenko <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
This commit is contained in:
Dmitry Osipenko authored and Mark Brown committed 2022-01-28 15:59:19 +00:00
1 parent fb25621da5
commit 06feec6005
2 files changed
+4 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

include/uapi/sound/asound.h
+3 -1
View File
@@ -56,8 +56,10 @@
* *
****************************************************************************/
#define AES_IEC958_STATUS_SIZE 24
struct snd_aes_iec958 {
unsigned char status[24]; /* AES/IEC958 channel status bits */
unsigned char status[AES_IEC958_STATUS_SIZE]; /* AES/IEC958 channel status bits */
unsigned char subcode[147]; /* AES/IEC958 subcode bits */
unsigned char pad; /* nothing */
unsigned char dig_subframe[4]; /* AES/IEC958 subframe bits */
sound/soc/codecs/hdmi-codec.c
+1 -1
View File
@@ -277,7 +277,7 @@ struct hdmi_codec_priv {
bool busy;
struct snd_soc_jack *jack;
unsigned int jack_status;
u8 iec_status[5];
u8 iec_status[AES_IEC958_STATUS_SIZE];
};
static const struct snd_soc_dapm_widget hdmi_widgets[] = {