diff options
| author | Alexandre Ratchov <ratchov@cvs.openbsd.org> | 2018-03-21 07:02:03 +0000 |
|---|---|---|
| committer | Alexandre Ratchov <ratchov@cvs.openbsd.org> | 2018-03-21 07:02:03 +0000 |
| commit | 34711e9cafa75a8234f3fbcb2ba27b9e7ba26c0c (patch) | |
| tree | 70bd768f8bc8903e29d230c68247f81357e9eb6a /sys/dev/audio.c | |
| parent | 831c499b8dafebc73518d1773a94d0562490b6c8 (diff) | |
Fix the way we detect xrun on the recording end, which may prevent the
ring read pointer from wrapping, in turn allowing the process to read
past the ring boundaries.
ok deraadt@
Diffstat (limited to 'sys/dev/audio.c')
| -rw-r--r-- | sys/dev/audio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/audio.c b/sys/dev/audio.c index ab0a1dca01c..9765b1d11a9 100644 --- a/sys/dev/audio.c +++ b/sys/dev/audio.c @@ -1,4 +1,4 @@ -/* $OpenBSD: audio.c,v 1.167 2018/01/10 09:03:26 ratchov Exp $ */ +/* $OpenBSD: audio.c,v 1.168 2018/03/21 07:02:02 ratchov Exp $ */ /* * Copyright (c) 2015 Alexandre Ratchov <alex@caoua.org> * @@ -462,7 +462,7 @@ audio_rintr(void *addr) sc->rec.pos += sc->rec.blksz; audio_buf_wcommit(&sc->rec, sc->rec.blksz); - if (sc->rec.used == sc->rec.len) { + if (sc->rec.used > sc->rec.len - sc->rec.blksz) { DPRINTFN(1, "%s: rec overrun\n", DEVNAME(sc)); sc->rec.xrun += sc->rec.blksz; audio_buf_rdiscard(&sc->rec, sc->rec.blksz); |