Message137924
> ossaudiodev's writeall method doesn't check that the FD is less than
> FD_SETSIZE when passing it to FD_SET: since FD_SET typically doesn't
> do bound check, it will write to a random location in memory (in this
> case on the stack).
> I've attached a test that triggers a segfault on my 32-bit Linux box:
> - you must have an OSS-compatible device as /dev/dsp (if you don't you
> can use "modprobe snd_pcm_oss")
> - it tries to increase RLIMIT_NOFILE since it's usually defined to be
> the same as FD_SETSIZE (1024 on Linux). The script must be run as root
> for that.
> A patch is attached.
Well, the test doesn't work here ("IOError: [Errno 16] Device or
resource busy: '/dev/dsp'", probably because of PulseAudio already using
it), but the patch looks simple enough.
By the way, this function still uses "y#" instead of "y*", this could be
the topic of another issue if you are interested. |
|
Date |
User |
Action |
Args |
2011-06-08 20:43:57 | pitrou | set | recipients:
+ pitrou, vstinner, neologix |
2011-06-08 20:43:57 | pitrou | link | issue12287 messages |
2011-06-08 20:43:57 | pitrou | create | |
|