01c0b4265c
snd_pcm_oss_get_formats() has an obvious use-after-free around snd_mask_test() calls, as spotted by syzbot. The passed format_mask argument is a pointer to the hw_params object that is freed before the loop. What a surprise that it has been present since the original code of decades ago... Reported-by: syzbot+4090700a4f13fccaf648@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| copy.c | ||
| io.c | ||
| linear.c | ||
| mixer_oss.c | ||
| mulaw.c | ||
| pcm_oss.c | ||
| pcm_plugin.c | ||
| pcm_plugin.h | ||
| rate.c | ||
| route.c | ||