Commit 4f50d4a4 authored by Volker Rümelin's avatar Volker Rümelin Committed by Gerd Hoffmann
Browse files

ossaudio: fix out of bounds write 



In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.

To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.

Fixes: 3ba4066d "ossaudio: port to the new audio backend api"

Signed-off-by: default avatarVolker Rümelin <vr_qemu@t-online.de>
Message-id: 20200707180836.5435-1-vr_qemu@t-online.de
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 9f526fce

audio/ossaudio.c

+1 −0
Original line number Diff line number Diff line
@@ -691,6 +691,7 @@ static size_t oss_read(HWVoiceIn *hw, void *buf, size_t len) 
                           len, dst);

                break;

            }

            break;

        }



        pos += nread;