Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ALSA: info: Check for integer overflow in snd_info_entry_write()
snd_info_entry_write() resizes the buffer with an unsigned long size argument that gets truncated because resize_info_buffer() takes the size parameter as an unsigned int. On 64-bit kernels, this causes the following copy_to_user() to write out-of-bounds if (pos + count) can't be represented by an unsigned int. Bug: 32510733 Change-Id: I9e8b55f93f2bd606b4a73b5a4525b71ee88c7c23 Signed-off-by: Siqi Lin <siqilin@google.com>
- Loading branch information