Skip to content

Commit cec8f96

Browse files
kengitertiwai
authored andcommitted
ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
The stack object “tread” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 242658f commit cec8f96

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: sound/core/timer.c

+1
Original file line numberDiff line numberDiff line change
@@ -1737,6 +1737,7 @@ static int snd_timer_user_params(struct file *file,
17371737
if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {
17381738
if (tu->tread) {
17391739
struct snd_timer_tread tread;
1740+
memset(&tread, 0, sizeof(tread));
17401741
tread.event = SNDRV_TIMER_EVENT_EARLY;
17411742
tread.tstamp.tv_sec = 0;
17421743
tread.tstamp.tv_nsec = 0;

0 commit comments

Comments
 (0)