From nobody Tue Feb 10 02:45:13 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1579765920; cv=none; d=zohomail.com; s=zohoarc; b=nH0549oVAKSnLsC5IaCHCCXgidx++vhF09yysf2DtrnPb0yGOHOprIMotyNs91lb8lt1Ww2bkxfcsUYp0MjcLGtKT0BZonmWQG3hacJz1jNxJKZtXZ7c9dc8PKELtBvi3zQSSjYf7a0K83fMO/4D5MjY8pgBHUTJtyao3ZXLqMw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1579765920; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=5CiFof4Lvx5denP5qr1CJDZWUwLcjGHSWaFCywIze4U=; b=cKPlPWEIgBXzqDk7iDFCjugl3EDi4qyhpZfe3iR3ixUJVCWYgCbZQ0UcZAYR5KgVHrFYgQNQmDr8VmB24xwW6H5mXiKkH9Gi13tauVnIRjb4A6Bgc7Jq72REiO8zRCl0BvfSclUM5xfBCJu6w1Oh7J9tXfbqJSOvbCGCrYJQu5E= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1579765920338430.76570125455885; Wed, 22 Jan 2020 23:52:00 -0800 (PST) Received: from localhost ([::1]:52382 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iuXHS-0007xe-N9 for importer@patchew.org; Thu, 23 Jan 2020 02:51:58 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:46203) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iuXFe-00064E-Tr for qemu-devel@nongnu.org; Thu, 23 Jan 2020 02:50:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iuXFd-0004k4-Or for qemu-devel@nongnu.org; Thu, 23 Jan 2020 02:50:06 -0500 Received: from mailout11.t-online.de ([194.25.134.85]:52880) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1iuXFd-0004iw-If for qemu-devel@nongnu.org; Thu, 23 Jan 2020 02:50:05 -0500 Received: from fwd28.aul.t-online.de (fwd28.aul.t-online.de [172.20.26.133]) by mailout11.t-online.de (Postfix) with SMTP id AB0C7420CE02; Thu, 23 Jan 2020 08:50:04 +0100 (CET) Received: from linpower.localnet (bHQziOZJ8hihzvynLX2VZ7WNABYdTbkckmy6-wzT15PRNqmXAUFxGBvKiAAcuHcw2P@[46.86.62.122]) by fwd28.t-online.de with (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384 encrypted) esmtp id 1iuXFb-4bEfKa0; Thu, 23 Jan 2020 08:50:03 +0100 Received: by linpower.localnet (Postfix, from userid 1000) id 62E8420109E; Thu, 23 Jan 2020 08:49:43 +0100 (CET) From: =?UTF-8?q?Volker=20R=C3=BCmelin?= To: Gerd Hoffmann Subject: [PATCH 9/9] audio: audio_generic_get_buffer_in should honor *size Date: Thu, 23 Jan 2020 08:49:43 +0100 Message-Id: <20200123074943.6699-9-vr_qemu@t-online.de> X-Mailer: git-send-email 2.16.4 In-Reply-To: <1e29e1d3-b59b-fcd6-cdff-a680bcdbffa4@t-online.de> References: <1e29e1d3-b59b-fcd6-cdff-a680bcdbffa4@t-online.de> MIME-Version: 1.0 X-ID: bHQziOZJ8hihzvynLX2VZ7WNABYdTbkckmy6-wzT15PRNqmXAUFxGBvKiAAcuHcw2P X-TOI-MSGID: 2e6beee5-9e20-489a-9183-2aa25db3e52f Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 194.25.134.85 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: QEMU , =?UTF-8?q?Zolt=C3=A1n=20K=C5=91v=C3=A1g=C3=B3?= Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" The function generic_get_buffer_in currently ignores the *size parameter and may return a buffer larger than *size. As a result the variable samples in function audio_pcm_hw_run_in may underflow. The while loop then most likely will never termiate. This bug was reported at http://bugs.debian.org/948658. Signed-off-by: Volker R=C3=BCmelin --- audio/audio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/audio/audio.c b/audio/audio.c index 81822bfec9..f5fb6cbf53 100644 --- a/audio/audio.c +++ b/audio/audio.c @@ -1406,7 +1406,8 @@ void *audio_generic_get_buffer_in(HWVoiceIn *hw, size= _t *size) } assert(start >=3D 0 && start < hw->size_emul); =20 - *size =3D MIN(hw->pending_emul, hw->size_emul - start); + *size =3D MIN(*size, hw->pending_emul); + *size =3D MIN(*size, hw->size_emul - start); return hw->buf_emul + start; } =20 --=20 2.16.4