diff options
| author | Volker Rümelin <vr_qemu@t-online.de> | 2020-07-07 20:08:36 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-07-13 11:38:40 +0200 |
| commit | 4f50d4a48e0caa1aad591f3ca437502e33b8699d (patch) | |
| tree | cba7b4cc0ab62895529c23386f30766fe4910fab /docs/qdev-device-use.txt | |
| parent | 9f526fce49c6ac48114ed04914b5a76e4db75785 (diff) | |
| download | focaccia-qemu-4f50d4a48e0caa1aad591f3ca437502e33b8699d.tar.gz focaccia-qemu-4f50d4a48e0caa1aad591f3ca437502e33b8699d.zip | |
ossaudio: fix out of bounds write
In function oss_read() a read error currently does not exit the read loop. With no data to read the variable pos will quickly underflow and a subsequent successful read overwrites memory outside the buffer. This patch adds the missing break statement to the error path of the function. To reproduce start qemu with -audiodev oss,id=audio0 and in the guest start audio recording. After some time this will trigger an exception. Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api" Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-id: 20200707180836.5435-1-vr_qemu@t-online.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'docs/qdev-device-use.txt')
0 files changed, 0 insertions, 0 deletions