leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sound: Fix buffer overflow in square wave generation

Browse Source 
Data is written for each channel but is only tracked as having one
channel written. This resulted in a buffer overflow and corruption of
the allocator's metadata which caused further problems when the buffer
was later freed. This could be observed with sandbox unit tests.

Resolve the overflow by tracking the writes for each channel.

Fixes: f987177db9 ("dm: sound: Use the correct number of channels for sound")
Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Andrew Scull 2022-04-03 10:39:13 +00:00 committed by Tom Rini
parent beb341ae7f
commit 49209da54f
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/sound/sound.c
View File

@ -25,13 +25,11 @@ void sound_create_square_wave(uint sample_rate, unsigned short *data, int size,
int i, j;
for (i = 0; size && i < half; i++) {
size -= 2;
for (j = 0; j < channels; j++)
for (j = 0; size && j < channels; j++, size -= 2)
*data++ = amplitude;
}
for (i = 0; size && i < period - half; i++) {
size -= 2;
for (j = 0; j < channels; j++)
for (j = 0; size && j < channels; j++, size -= 2)
*data++ = -amplitude;
}
}