diff options
| author | Dmitry Osipenko <digetx@gmail.com> | 2022-01-12 22:50:39 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-02-08 20:34:03 +0300 |
| commit | 10007bd96b6c4c3cfaea9e76c311b06a07a5e260 (patch) | |
| tree | dfaab735ea4bfa1c6b90bd17140de1e0a1794323 /include/uapi/sound | |
| parent | 0b8b029031735d1a4d452080ad791ddac4302ca6 (diff) | |
| download | linux-10007bd96b6c4c3cfaea9e76c311b06a07a5e260.tar.xz | |
ASoC: hdmi-codec: Fix OOB memory accesses
commit 06feec6005c9d9500cd286ec440aabf8b2ddd94d upstream.
Correct size of iec_status array by changing it to the size of status
array of the struct snd_aes_iec958. This fixes out-of-bounds slab
read accesses made by memcpy() of the hdmi-codec driver. This problem
is reported by KASAN.
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20220112195039.1329-1-digetx@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/uapi/sound')
| -rw-r--r-- | include/uapi/sound/asound.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/include/uapi/sound/asound.h b/include/uapi/sound/asound.h index 5859ca0a1439..93e40f91bd49 100644 --- a/include/uapi/sound/asound.h +++ b/include/uapi/sound/asound.h @@ -56,8 +56,10 @@ * * ****************************************************************************/ +#define AES_IEC958_STATUS_SIZE 24 + struct snd_aes_iec958 { - unsigned char status[24]; /* AES/IEC958 channel status bits */ + unsigned char status[AES_IEC958_STATUS_SIZE]; /* AES/IEC958 channel status bits */ unsigned char subcode[147]; /* AES/IEC958 subcode bits */ unsigned char pad; /* nothing */ unsigned char dig_subframe[4]; /* AES/IEC958 subframe bits */ |