Browse Source

ALSA: compress: info leak in snd_compr_get_caps()

If the ->get_caps() function doesn't clear the buffer then there would
stack information leaked to userspace.  For example,
soc_compr_get_caps() can return success without clearing the buffer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dan Carpenter 12 years ago
parent
commit
1c62e9f2b5
1 changed files with 1 additions and 0 deletions
  1. 1 0
      sound/core/compress_offload.c

+ 1 - 0
sound/core/compress_offload.c

@@ -409,6 +409,7 @@ snd_compr_get_caps(struct snd_compr_stream *stream, unsigned long arg)
 	if (!stream->ops->get_caps)
 		return -ENXIO;
 
+	memset(&caps, 0, sizeof(caps));
 	retval = stream->ops->get_caps(stream, &caps);
 	if (retval)
 		goto out;