tree 1fa0b01d3222c5981d00e8a7cb769403077b6c2e
parent 4f8b2d599319bb3a45f4ef513492a5ea4d6a5d81
author Siqi Lin <siqilin@google.com> 1478130668 -0700
committer Teemu Hukkanen <teemu@fairphone.com> 1485724821 +0100

FPII-2725:ALSA: info: Check for integer overflow in snd_info_entry_write() CVE-2017-0404 A-32510733

ALSA: info: Check for integer overflow in snd_info_entry_write()

snd_info_entry_write() resizes the buffer with an unsigned long
size argument that gets truncated because resize_info_buffer()
takes the size parameter as an unsigned int. On 64-bit kernels,
this causes the following copy_to_user() to write out-of-bounds
if (pos + count) can't be represented by an unsigned int.

Bug: 32510733
Change-Id: I9e8b55f93f2bd606b4a73b5a4525b71ee88c7c23
Signed-off-by: Siqi Lin <siqilin@google.com>