Dan Rosenberg 5591bf0722 ALSA: prevent heap corruption in snd_ctl_new() ...

The snd_ctl_new() function in sound/core/control.c allocates space for a
snd_kcontrol struct by performing arithmetic operations on a
user-provided size without checking for integer overflow.  If a user
provides a large enough size, an overflow will occur, the allocated
chunk will be too small, and a second user-influenced value will be
written repeatedly past the bounds of this chunk.  This code is
reachable by unprivileged users who have permission to open
a /dev/snd/controlC* device (on many distros, this is group "audio") via
the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

2010-09-28 21:33:16 +02:00

..

oss

ALSA: core - Define llseek fops

2010-04-13 12:01:21 +02:00

seq

ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()

2010-09-08 10:45:34 +02:00

control_compat.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

control.c

ALSA: prevent heap corruption in snd_ctl_new()

2010-09-28 21:33:16 +02:00

device.c

…

hrtimer.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

hwdep_compat.c

…

hwdep.c

…

info_oss.c

…

info.c

ALSA: info - Implement common llseek for binary mode

2010-04-13 12:01:20 +02:00

init.c

…

isadma.c

…

jack.c

Merge branch 'topic/jack' into for-linus

2010-05-20 11:59:37 +02:00

Kconfig

ALSA: sound/core/pcm_timer.c: use lib/gcd.c

2009-12-22 08:24:35 +01:00

Makefile

…

memalloc.c

…

memory.c

…

misc.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

pcm_compat.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

pcm_lib.c

ALSA: pcm core - add a safe check to the silence filling function

2010-07-19 16:47:01 +02:00

pcm_memory.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

pcm_misc.c

ALSA: pcm: Define G723 3-bit and 5-bit formats

2010-05-31 09:10:03 +02:00

pcm_native.c

ALSA: pcm - Fix unbalanced pm_qos_request

2010-09-16 23:04:38 +02:00

pcm_timer.c

ALSA: sound/core/pcm_timer.c: use lib/gcd.c

2009-12-22 08:24:35 +01:00

pcm.c

ALSA: pcm - Fix race with proc files

2010-09-16 23:06:50 +02:00

rawmidi_compat.c

…

rawmidi.c

ALSA: rawmidi: fix the get next midi device ioctl

2010-09-09 09:05:21 +02:00

rtctimer.c

…

sgbuf.c

…

sound_oss.c

ALSA: Remove warning message for invalid OSS minor ranges

2010-01-18 14:18:55 +01:00

sound.c

ALSA: Remove BKL from open multiplexer

2010-04-09 10:28:36 +02:00

timer_compat.c

…

timer.c

Merge branch 'topic/core-cleanup' into for-linus

2010-05-20 11:58:57 +02:00

vmaster.c

…