diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-04-21 14:07:29 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2013-04-22 10:34:46 +0200 |
| commit | 1c62e9f2b5a97c53aaae490f844949d32cca6dc6 (patch) | |
| tree | 8a69eaf2daf2872b21b3617fe9072ead3422fa09 /sound | |
| parent | f0283b58d01d36910fcd195d1fc365a3356b2be0 (diff) | |
| download | linux-3.10-1c62e9f2b5a97c53aaae490f844949d32cca6dc6.tar.gz linux-3.10-1c62e9f2b5a97c53aaae490f844949d32cca6dc6.tar.bz2 linux-3.10-1c62e9f2b5a97c53aaae490f844949d32cca6dc6.zip | |
ALSA: compress: info leak in snd_compr_get_caps()
If the ->get_caps() function doesn't clear the buffer then there would
stack information leaked to userspace. For example,
soc_compr_get_caps() can return success without clearing the buffer.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/compress_offload.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 7941ace7828..664c69398b4 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -409,6 +409,7 @@ snd_compr_get_caps(struct snd_compr_stream *stream, unsigned long arg) if (!stream->ops->get_caps) return -ENXIO; + memset(&caps, 0, sizeof(caps)); retval = stream->ops->get_caps(stream, &caps); if (retval) goto out; |