ASoC: hdmi-codec: Fix OOB memory accesses

Correct size of iec_status array by changing it to the size of status array of the struct snd_aes_iec958. This fixes out-of-bounds slab read accesses made by memcpy() of the hdmi-codec driver. This problem is reported by KASAN.

Dmitry Osipenko committed 4 years ago

Commit 06feec61 parent fb256212 files · +4 −2Browse files

Showing the changes to include/uapi (1 of 2 files). Show all

Unified · Split

include/uapi/sound/asound.h+3−1

@@ -56,8 +56,10 @@ · 55 unmodified lines
56	56	* *
57	57	****************************************************************************/
58	58
	59	+#define AES_IEC958_STATUS_SIZE 24
	60	+
59	61	struct snd_aes_iec958 {
60		− unsigned char status[24]; /* AES/IEC958 channel status bits */
	62	+ unsigned char status[AES_IEC958_STATUS_SIZE]; /* AES/IEC958 channel status bits */
61	63	unsigned char subcode[147]; /* AES/IEC958 subcode bits */
62	64	unsigned char pad; /* nothing */
63	65	unsigned char dig_subframe[4]; /* AES/IEC958 subframe bits */