Skip to content

Commit e4ec8cc

Browse files
kengitertiwai
authored andcommitted
ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 9a47e9c commit e4ec8cc

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: sound/core/timer.c

+1
Original file line numberDiff line numberDiff line change
@@ -1266,6 +1266,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri,
12661266
}
12671267
if ((tu->filter & (1 << SNDRV_TIMER_EVENT_RESOLUTION)) &&
12681268
tu->last_resolution != resolution) {
1269+
memset(&r1, 0, sizeof(r1));
12691270
r1.event = SNDRV_TIMER_EVENT_RESOLUTION;
12701271
r1.tstamp = tstamp;
12711272
r1.val = resolution;

0 commit comments

Comments
 (0)