At Sun, 21 Apr 2013 14:07:29 +0300, Dan Carpenter wrote:
If the ->get_caps() function doesn't clear the buffer then there would stack information leaked to userspace. For example, soc_compr_get_caps() can return success without clearing the buffer.
Thanks, applied now.
I found that we have also a similar problem in other ioctls (snd_compr_get_codec_caps() and snd_compr_get_params()), so applied the following patch in addition.
Takashi
--- From: Takashi Iwai tiwai@suse.de Subject: [PATCH] ALSA: compress: Use kzalloc() for ioctls writing back data
Like the previous patch by Dan, we should clear the data to be returned from certain compress ioctls, namely, snd_compr_get_codec_caps() and snd_compr_get_params(). This time, we can simply replace kmalloc() with kzalloc().
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/core/compress_offload.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 664c693..a0bc47f 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -428,7 +428,7 @@ snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg) if (!stream->ops->get_codec_caps) return -ENXIO;
- caps = kmalloc(sizeof(*caps), GFP_KERNEL); + caps = kzalloc(sizeof(*caps), GFP_KERNEL); if (!caps) return -ENOMEM;
@@ -545,7 +545,7 @@ snd_compr_get_params(struct snd_compr_stream *stream, unsigned long arg) if (!stream->ops->get_params) return -EBADFD;
- params = kmalloc(sizeof(*params), GFP_KERNEL); + params = kzalloc(sizeof(*params), GFP_KERNEL); if (!params) return -ENOMEM; retval = stream->ops->get_params(stream, params);