Correct size of iec_status array by changing it to the size of status array of the struct snd_aes_iec958. This fixes out-of-bounds slab read accesses made by memcpy() of the hdmi-codec driver. This problem is reported by KASAN.
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -56,8 +56,10 @@ · 55 unmodified lines | |||
| 56 | * * | 56 | * * |
| 57 | ****************************************************************************/ | 57 | ****************************************************************************/ |
| 58 | 58 | ||
| 59 | #define AES_IEC958_STATUS_SIZE 24 | ||
| 60 | |||
| 59 | struct snd_aes_iec958 { | 61 | struct snd_aes_iec958 { |
| 60 | unsigned char status[24]; /* AES/IEC958 channel status bits */ | 62 | unsigned char status[AES_IEC958_STATUS_SIZE]; /* AES/IEC958 channel status bits */ |
| 61 | unsigned char subcode[147]; /* AES/IEC958 subcode bits */ | 63 | unsigned char subcode[147]; /* AES/IEC958 subcode bits */ |
| 62 | unsigned char pad; /* nothing */ | 64 | unsigned char pad; /* nothing */ |
| 63 | unsigned char dig_subframe[4]; /* AES/IEC958 subframe bits */ | 65 | unsigned char dig_subframe[4]; /* AES/IEC958 subframe bits */ |