Wed Apr 22 18:12:26 2020 UTC ()
Pull up following revision(s) (requested by maxv in ticket #841):

	sys/compat/ossaudio/ossaudio.c: revision 1.83

ossaudio: Avoid giving userland uninitialized memory. Noticed by maxv.

The uninitalized field in this structure is `fillers`, an array that
simply reserves space for later changes in OSSv4, which this version
of the OSS compat layer (specifically for Linux applications) makes no
effort to implement.


(martin)
diff -r1.74.4.2 -r1.74.4.3 src/sys/compat/ossaudio/ossaudio.c
cvs diff -r1.74.4.2 -r1.74.4.3 src/sys/compat/ossaudio/ossaudio.c (expand / switch to unified diff)

--- src/sys/compat/ossaudio/ossaudio.c 2019/11/19 11:01:27 1.74.4.2
+++ src/sys/compat/ossaudio/ossaudio.c 2020/04/22 18:12:26 1.74.4.3
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: ossaudio.c,v 1.74.4.2 2019/11/19 11:01:27 martin Exp $ */ 1/* $NetBSD: ossaudio.c,v 1.74.4.3 2020/04/22 18:12:26 martin Exp $ */
2 2
3/*- 3/*-
4 * Copyright (c) 1997, 2008 The NetBSD Foundation, Inc. 4 * Copyright (c) 1997, 2008 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Redistribution and use in source and binary forms, with or without 7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions 8 * modification, are permitted provided that the following conditions
9 * are met: 9 * are met:
10 * 1. Redistributions of source code must retain the above copyright 10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer. 11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright 12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the 13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution. 14 * documentation and/or other materials provided with the distribution.
@@ -17,27 +17,27 @@ @@ -17,27 +17,27 @@
17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE. 26 * POSSIBILITY OF SUCH DAMAGE.
27 */ 27 */
28 28
29#include <sys/cdefs.h> 29#include <sys/cdefs.h>
30__KERNEL_RCSID(0, "$NetBSD: ossaudio.c,v 1.74.4.2 2019/11/19 11:01:27 martin Exp $"); 30__KERNEL_RCSID(0, "$NetBSD: ossaudio.c,v 1.74.4.3 2020/04/22 18:12:26 martin Exp $");
31 31
32#include <sys/param.h> 32#include <sys/param.h>
33#include <sys/proc.h> 33#include <sys/proc.h>
34#include <sys/systm.h> 34#include <sys/systm.h>
35#include <sys/file.h> 35#include <sys/file.h>
36#include <sys/vnode.h> 36#include <sys/vnode.h>
37#include <sys/filedesc.h> 37#include <sys/filedesc.h>
38#include <sys/ioctl.h> 38#include <sys/ioctl.h>
39#include <sys/mount.h> 39#include <sys/mount.h>
40#include <sys/kernel.h> 40#include <sys/kernel.h>
41#include <sys/audioio.h> 41#include <sys/audioio.h>
42#include <sys/midiio.h> 42#include <sys/midiio.h>
43#include <sys/kauth.h> 43#include <sys/kauth.h>
@@ -1074,26 +1074,27 @@ oss_ioctl_mixer(struct lwp *lwp, const s @@ -1074,26 +1074,27 @@ oss_ioctl_mixer(struct lwp *lwp, const s
1074 ioctlf = fp->f_ops->fo_ioctl; 1074 ioctlf = fp->f_ops->fo_ioctl;
1075 switch (com) { 1075 switch (com) {
1076 case OSS_GET_VERSION: 1076 case OSS_GET_VERSION:
1077 idat = OSS_SOUND_VERSION; 1077 idat = OSS_SOUND_VERSION;
1078 break; 1078 break;
1079 case OSS_SOUND_MIXER_INFO: 1079 case OSS_SOUND_MIXER_INFO:
1080 case OSS_SOUND_OLD_MIXER_INFO: 1080 case OSS_SOUND_OLD_MIXER_INFO:
1081 error = ioctlf(fp, AUDIO_GETDEV, &adev); 1081 error = ioctlf(fp, AUDIO_GETDEV, &adev);
1082 if (error) { 1082 if (error) {
1083 DPRINTF(("%s: AUDIO_GETDEV %d\n", 1083 DPRINTF(("%s: AUDIO_GETDEV %d\n",
1084 __func__, error)); 1084 __func__, error));
1085 goto out; 1085 goto out;
1086 } 1086 }
 1087 memset(&omi, 0, sizeof omi);
1087 omi.modify_counter = 1; 1088 omi.modify_counter = 1;
1088 strncpy(omi.id, adev.name, sizeof omi.id); 1089 strncpy(omi.id, adev.name, sizeof omi.id);
1089 strncpy(omi.name, adev.name, sizeof omi.name); 1090 strncpy(omi.name, adev.name, sizeof omi.name);
1090 error = copyout(&omi, SCARG(uap, data), OSS_IOCTL_SIZE(com)); 1091 error = copyout(&omi, SCARG(uap, data), OSS_IOCTL_SIZE(com));
1091 if (error) { 1092 if (error) {
1092 DPRINTF(("%s: OSS_SOUND_MIXER_INFO %d\n", 1093 DPRINTF(("%s: OSS_SOUND_MIXER_INFO %d\n",
1093 __func__, error)); 1094 __func__, error));
1094 goto out; 1095 goto out;
1095 } 1096 }
1096 break; 1097 break;
1097 case OSS_SOUND_MIXER_READ_RECSRC: 1098 case OSS_SOUND_MIXER_READ_RECSRC:
1098 if (di->source == -1) { 1099 if (di->source == -1) {
1099 DPRINTF(("%s: OSS_SOUND_MIXER_READ_RECSRC bad source\n", 1100 DPRINTF(("%s: OSS_SOUND_MIXER_READ_RECSRC bad source\n",