Skip to content

Commit 9a47e9c

Browse files
kengitertiwai
authored andcommitted
ALSA: timer: Fix leak in events via snd_timer_user_ccallback
The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent cec8f96 commit 9a47e9c

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: sound/core/timer.c

+1
Original file line numberDiff line numberDiff line change
@@ -1223,6 +1223,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
12231223
tu->tstamp = *tstamp;
12241224
if ((tu->filter & (1 << event)) == 0 || !tu->tread)
12251225
return;
1226+
memset(&r1, 0, sizeof(r1));
12261227
r1.event = event;
12271228
r1.tstamp = *tstamp;
12281229
r1.val = resolution;

0 commit comments

Comments
 (0)