mirror of
https://github.com/alsa-project/alsa-lib.git
synced 2025-10-31 22:25:35 -04:00
The Advanced Linux Sound Architecture (ALSA) - library
7c5c050090
The qlen field of struct snd_midi_event was declared as size_t while status_events[] assigns the qlen to -1 indicating to skip. This leads to the misinterpretation since size_t is unsigned, hence it passes the check "dev.qlen > 0" incorrectly in snd_midi_event_encode_byte(), which eventually results in a memory corruption. Also, snd_midi_event_decode() doesn't consider about a negative qlen value and tries to copy the size as is. This patch fixes these issues: the first one is addressed by simply replacing size_t with ssize_t in snd_midi_event struct. For the latter, a check "qlen <= 0" is added to bail out; this is also good as a slight optimization. Reported-by: Prashant Malani <pmalani@chromium.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| alsalisp | ||
| aserver | ||
| doc | ||
| include | ||
| m4 | ||
| modules | ||
| src | ||
| test | ||
| utils | ||
| .gitignore | ||
| acinclude.m4 | ||
| ChangeLog | ||
| configure.ac | ||
| COPYING | ||
| gitcompile | ||
| INSTALL | ||
| Makefile.am | ||
| MEMORY-LEAK | ||
| NOTES | ||
| TODO | ||