]> git.alsa-project.org Git - alsa-utils.git/commit
topology: Fix strcat() to uninitialized memory in
authorRichard Fitzgerald <rf@opensource.cirrus.com>
Thu, 7 Nov 2024 11:57:17 +0000 (11:57 +0000)
committerJaroslav Kysela <perex@perex.cz>
Tue, 12 Nov 2024 09:17:11 +0000 (10:17 +0100)
commit03e7f3ac0dd4b0a71619c6bdf80c4ae50edebfdf
tree8d6d7515d8480e20c025a5d969b5d8d3749f5ac8
parent8116639e560958c48e367e0e1dea923f247cbb76
topology: Fix strcat() to uninitialized memory in

If *defs == NULL the realloc() will be a simple malloc() and return a
pointer to uninitialized memory. Doing a strcat() to this is bad, so in
that case strcpy() the string into the newly allocated buffer.

This fixes the buffer overflow bug, such as:

*** buffer overflow detected ***: terminated
Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
warning: 44     ./nptl/pthread_kill.c: No such file or directory
(gdb) bt
    at ../sysdeps/posix/libc_fatal.c:132
    at ./debug/fortify_fail.c:24
    dest=dest@entry=0x5555555682c0 "hUUU\005PLATFORM=mtl,PREPROCESS_PLUGINS=nhlt,NHLT_BIN=nhlt-sof-mtl-sdw-cs42l42-l0-max98363-l2-4ch-48k-96k.bin,NUM_DMICS=4,PDM1_MIC_A_ENABLE=1,PDM1_MIC_B_ENABLE=1,DMIC0_ID=3,DMIC1_ID=4,DMIC1_ENABLE=passth"...,
    src=src@entry=0x7fffffffe0fa "PLATFORM=mtl,PREPROCESS_PLUGINS=nhlt,NHLT_BIN=nhlt-sof-mtl-sdw-cs42l42-l0-max98363-l2-4ch-48k-96k.bin,NUM_DMICS=4,PDM1_MIC_A_ENABLE=1,PDM1_MIC_B_ENABLE=1,DMIC0_ID=3,DMIC1_ID=4,DMIC1_ENABLE=passthrough"..., destlen=<optimized out>) at ./debug/strcat_chk.c:34
    __src=0x7fffffffe0fa "PLATFORM=mtl,PREPROCESS_PLUGINS=nhlt,NHLT_BIN=nhlt-sof-mtl-sdw-cs42l42-l0-max98363-l2-4ch-48k-96k.bin,NUM_DMICS=4,PDM1_MIC_A_ENABLE=1,PDM1_MIC_B_ENABLE=1,DMIC0_ID=3,DMIC1_ID=4,DMIC1_ENABLE=passthrough"...,
    __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:130
    d=0x7fffffffe0fa "PLATFORM=mtl,PREPROCESS_PLUGINS=nhlt,NHLT_BIN=nhlt-sof-mtl-sdw-cs42l42-l0-max98363-l2-4ch-48k-96k.bin,NUM_DMICS=4,PDM1_MIC_A_ENABLE=1,PDM1_MIC_B_ENABLE=1,DMIC0_ID=3,DMIC1_ID=4,DMIC1_ENABLE=passthrough"...,
    defs=<synthetic pointer>) at topology.c:400

Closes: https://github.com/alsa-project/alsa-utils/pull/277
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
topology/topology.c