| commit | 01c0b4265cc16bc1f43f475c5944c55c10d5768f | [log] [tgz] |
|---|---|---|
| author | Takashi Iwai <tiwai@suse.de> | Sat Mar 10 23:04:23 2018 +0100 |
| committer | Takashi Iwai <tiwai@suse.de> | Sun Mar 11 10:25:10 2018 +0100 |
| tree | 1b6bcb6a25c2c4d73eb9f3247f63c84216f6a9bb | |
| parent | a2ff19f7b70118ced291a28d5313469914de451b [diff] |
ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() snd_pcm_oss_get_formats() has an obvious use-after-free around snd_mask_test() calls, as spotted by syzbot. The passed format_mask argument is a pointer to the hw_params object that is freed before the loop. What a surprise that it has been present since the original code of decades ago... Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>