| Summary: | Voxware MIXER_READ ioctl corrupts memory | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Randall Hopper <aa8vb> |
| Component: | kern | Assignee: | freebsd-bugs (Nobody) <bugs> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | CC: | aa8vb |
| Priority: | Normal | ||
| Version: | 3.2-RELEASE | ||
| Hardware: | Any | ||
| OS: | Any | ||
State Changed From-To: open->closed We have a new sound subsystem. |
int stomp_me = 0x12345678; unsigned char vol[2]; ioctl( mixer_fd, MIXER_READ( SOUND_MIXER_LINE ), vol ) The ioctl overwrites the lower two bytes of 'stomp_me'. This is how Linux apps like xmix declare vol, so apparently this is a bug in our Voxware drivers. xmix may be saved from memory corruption only by the structure alignment policy of FreeBSD. How-To-Repeat: The output of the following program is: #include <stdio.h> #include <unistd.h> #include <fcntl.h> #include <machine/soundcard.h> #include <assert.h> int main( int argc, char *argv[] ) { int mixer_fd, ret, ctrls; int stomp_me = 0x12345678; unsigned char vol[2]; mixer_fd = open( "/dev/mixer0", O_RDWR, 0 ); assert( mixer_fd >= 0 ); ret = ioctl( mixer_fd, SOUND_MIXER_READ_DEVMASK, &ctrls ); assert( ret >= 0 ); assert( ctrls & SOUND_MASK_LINE ); ret = ioctl( mixer_fd, MIXER_READ( SOUND_MIXER_LINE ), vol ); assert( ret >= 0 ); printf( "Volume is %d,%d\n", vol[0], vol[1] ); if ( stomp_me != 0x12345678 ) { fprintf( stderr, "\n\nWhooah! Sound ioctl() stomped memory!\n" "Value was 0x12345678, now it's 0x%.8x\n", stomp_me ); exit(1); } close( mixer_fd ); return 0; }