| From 217bfbb8b0bfa24619b11ab75c135fec99b99b20 Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Fri, 15 Jan 2021 10:34:28 +0100 |
| Subject: ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit 217bfbb8b0bfa24619b11ab75c135fec99b99b20 upstream. |
| |
| snd_seq_oss_synth_make_info() didn't check the error code from |
| snd_seq_oss_midi_make_info(), and this leads to the call of strlcpy() |
| with the uninitialized string as the source, which may lead to the |
| access over the limit. |
| |
| Add the proper error check for avoiding the failure. |
| |
| Reported-by: syzbot+e42504ff21cff05a595f@syzkaller.appspotmail.com |
| Cc: <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/20210115093428.15882-1-tiwai@suse.de |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/core/seq/oss/seq_oss_synth.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/sound/core/seq/oss/seq_oss_synth.c |
| +++ b/sound/core/seq/oss/seq_oss_synth.c |
| @@ -624,7 +624,8 @@ snd_seq_oss_synth_make_info(struct seq_o |
| |
| if (info->is_midi) { |
| struct midi_info minf; |
| - snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); |
| + if (snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf)) |
| + return -ENXIO; |
| inf->synth_type = SYNTH_TYPE_MIDI; |
| inf->synth_subtype = 0; |
| inf->nr_voices = 16; |
