From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756590AbcECUlJ (ORCPT ); Tue, 3 May 2016 16:41:09 -0400 Received: from mail-yw0-f175.google.com ([209.85.161.175]:35105 "EHLO mail-yw0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756546AbcECUlH (ORCPT ); Tue, 3 May 2016 16:41:07 -0400 From: Kangjie Lu X-Google-Original-From: Kangjie Lu To: perex@perex.cz Cc: tiwai@suse.com, linux-kernel@vger.kernel.org, alsa-devel@alsa-project.org, taesoo@gatech.edu, insu@gatech.edu, Kangjie Lu Subject: [PATCH] infoleak fix1 in timer Date: Tue, 3 May 2016 16:44:07 -0400 Message-Id: <1462308247-6178-1-git-send-email-kjlu@gatech.edu> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The stack object “tread” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 6469bed..964f5eb 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1739,6 +1739,7 @@ static int snd_timer_user_params(struct file *file, if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) { if (tu->tread) { struct snd_timer_tread tread; + memset(&tread, 0, sizeof(tread)); tread.event = SNDRV_TIMER_EVENT_EARLY; tread.tstamp.tv_sec = 0; tread.tstamp.tv_nsec = 0; -- 1.9.1