Date: Sun, 5 Sep 1999 20:46:44 -0400 (EDT) From: aa8vb@ipass.net To: FreeBSD-gnats-submit@freebsd.org Cc: aa8vb@ipass.net Subject: kern/13587: Voxware MIXER_READ ioctl corrupts memory Message-ID: <199909060046.UAA13229@stealth.ipass.net.>
next in thread | raw e-mail | index | archive | help
>Number: 13587
>Category: kern
>Synopsis: Voxware MIXER_READ ioctl corrupts memory
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Sep 5 17:50:01 PDT 1999
>Closed-Date:
>Last-Modified:
>Originator: Randall Hopper
>Release: FreeBSD 3.2-RELEASE i386
>Organization:
self
>Environment:
Stock 3.2-RELEASE. Voxware sound drivers. Sound Blaster 32.
controller snd0
device pas0 at isa? port 0x388 irq 10 drq 3
device sb0 at isa? port 0x220 irq 5 drq 1
device sbxvi0 at isa? drq 5
device sbmidi0 at isa? port 0x330
device opl0 at isa? port 0x388
device awe0 at isa? port 0x620
>Description:
int stomp_me = 0x12345678;
unsigned char vol[2];
ioctl( mixer_fd, MIXER_READ( SOUND_MIXER_LINE ), vol )
The ioctl overwrites the lower two bytes of 'stomp_me'. This is
how Linux apps like xmix declare vol, so apparently this is a bug
in our Voxware drivers. xmix may be saved from memory corruption
only by the structure alignment policy of FreeBSD.
>How-To-Repeat:
The output of the following program is:
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <machine/soundcard.h>
#include <assert.h>
int main( int argc, char *argv[] )
{
int mixer_fd, ret, ctrls;
int stomp_me = 0x12345678;
unsigned char vol[2];
mixer_fd = open( "/dev/mixer0", O_RDWR, 0 );
assert( mixer_fd >= 0 );
ret = ioctl( mixer_fd, SOUND_MIXER_READ_DEVMASK, &ctrls );
assert( ret >= 0 );
assert( ctrls & SOUND_MASK_LINE );
ret = ioctl( mixer_fd, MIXER_READ( SOUND_MIXER_LINE ), vol );
assert( ret >= 0 );
printf( "Volume is %d,%d\n", vol[0], vol[1] );
if ( stomp_me != 0x12345678 ) {
fprintf( stderr, "\n\nWhooah! Sound ioctl() stomped memory!\n"
"Value was 0x12345678, now it's 0x%.8x\n",
stomp_me );
exit(1);
}
close( mixer_fd );
return 0;
}
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199909060046.UAA13229>