From: David Henningsson <david.henningsson@canonical.com>
Date: Mon, 10 Jun 2013 14:42:47 +0000 (+0200)
Subject: pcm_hw: Fix buffer overflow in chmap
X-Git-Tag: v1.0.27.2~2
X-Git-Url: https://git.alsa-project.org/?a=commitdiff_plain;h=c91785e002b96afad344a8ab182e8d33e355b7f7;p=alsa-lib.git

pcm_hw: Fix buffer overflow in chmap

We can't calculate memory storage in bytes, when we're supposed
to store ints in it!

Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
---

diff --git a/src/pcm/pcm_hw.c b/src/pcm/pcm_hw.c
index 196393d0..9ff83a92 100644
--- a/src/pcm/pcm_hw.c
+++ b/src/pcm/pcm_hw.c
@@ -1187,7 +1187,7 @@ static snd_pcm_chmap_t *snd_pcm_hw_get_chmap(snd_pcm_t *pcm)
 		       snd_pcm_state_name(FAST_PCM_STATE(hw)));
 		return NULL;
 	}
-	map = malloc(pcm->channels + 1);
+	map = malloc(pcm->channels * sizeof(map->pos[0]) + sizeof(*map));
 	if (!map)
 		return NULL;
 	map->channels = pcm->channels;