Merge 2185bc70a9 into 02b0c3af56

aseqdump: Avoid OOB access with broken SysEx UMP packets
UMP SysEx messages have length field to specify the contained data bytes, but they can be over the actual packet size. Add the proper size limit checks for avoiding the access overflow. Signed-off-by: Takashi Iwai <tiwai@suse.de>
2024-10-06 04:18:00 +02:00 · 2024-07-25 15:18:20 -07:00 · 2024-07-24 14:05:55 +02:00 · 2024-07-24 13:59:05 +02:00 · 2024-07-22 09:03:00 +03:00
2 changed files with 41 additions and 9 deletions
--- a/aplay/aplay.c
+++ b/aplay/aplay.c
@ -1618,6 +1618,8 @@ static void do_pause(void)
 		error(_("pause push error: %s"), snd_strerror(err));
 		return;
 	}
+	fprintf(stderr, _("\r=== PAUSE ===                                                            "));
+	fflush(stderr);
 	while (1) {
 		b = wait_for_input();
 		if (b == ' ' || b == '\r') {
@ -1642,8 +1644,6 @@ static void check_stdin(void)
 		while (read(fileno(stdin), &b, 1) == 1) {
 			if (b == ' ' || b == '\r') {
 				while (read(fileno(stdin), &b, 1) == 1);
-				fprintf(stderr, _("\r=== PAUSE ===                                                            "));
-				fflush(stderr);
 				do_pause();
 				fprintf(stderr, "                                                                          \r");
 				fflush(stderr);
--- a/seq/aseqdump/aseqdump.c
+++ b/seq/aseqdump/aseqdump.c
@ -668,13 +668,10 @@ static unsigned char ump_sysex7_data(const unsigned int *ump,
 	return (ump[offset / 4] >> ((3 - (offset & 3)) * 8)) & 0xff;
 }

-static void dump_ump_sysex_event(const unsigned int *ump)
+static void dump_ump_sysex_status(const char *prefix, unsigned int status)
 {
-	int i, length;
-
-	printf("Group %2d, ", group_number(snd_ump_msg_group(ump)));
-	printf("SysEx ");
-	switch (snd_ump_sysex_msg_status(ump)) {
+	printf("%s ", prefix);
+	switch (status) {
 	case SND_UMP_SYSEX_STATUS_SINGLE:
 		printf("Single  ");
 		break;
@ -688,17 +685,49 @@ static void dump_ump_sysex_event(const unsigned int *ump)
 		printf("End     ");
 		break;
 	default:
-		printf("Unknown(0x%x)", snd_ump_sysex_msg_status(ump));
+		printf("(0x%04x)", status);
 		break;
 	}
+}

+static void dump_ump_sysex_event(const unsigned int *ump)
+{
+	int i, length;
+
+	printf("Group %2d, ", group_number(snd_ump_msg_group(ump)));
+	dump_ump_sysex_status("SysEx", snd_ump_sysex_msg_status(ump));
 	length = snd_ump_sysex_msg_length(ump);
 	printf(" length %d ", length);
+	if (length > 14)
+		length = 14;
 	for (i = 0; i < length; i++)
 		printf("%s%02x", i ? ":" : "", ump_sysex7_data(ump, i));
 	printf("\n");
 }

+static unsigned char ump_sysex8_data(const unsigned int *ump,
+				     unsigned int offset)
+{
+	offset += 3;
+	return (ump[offset / 4] >> ((3 - (offset & 3)) * 8)) & 0xff;
+}
+
+static void dump_ump_sysex8_event(const unsigned int *ump)
+{
+	int i, length;
+
+	printf("Group %2d, ", group_number(snd_ump_msg_group(ump)));
+	dump_ump_sysex_status("SysEx8", snd_ump_sysex_msg_status(ump));
+	length = snd_ump_sysex_msg_length(ump);
+	printf(" length %d ", length);
+	printf(" stream %d ", (ump[0] >> 8) & 0xff);
+	if (length > 13)
+		length = 13;
+	for (i = 0; i < length; i++)
+		printf("%s%02x", i ? ":" : "", ump_sysex8_data(ump, i));
+	printf("\n");
+}
+
 static void print_ump_string(const unsigned int *ump, unsigned int fmt,
 			     unsigned int offset, int maxlen)
 {
@ -965,6 +994,9 @@ static void dump_ump_event(const snd_seq_ump_event_t *ev)
 	case SND_UMP_MSG_TYPE_DATA:
 		dump_ump_sysex_event(ev->ump);
 		break;
+	case SND_UMP_MSG_TYPE_EXTENDED_DATA:
+		dump_ump_sysex8_event(ev->ump);
+		break;
 	case SND_UMP_MSG_TYPE_FLEX_DATA:
 		dump_ump_flex_data_event(ev->ump);
 		break;
Author	SHA1	Message	Date
Péter Ujfalusi	ff8e339505	Merge `2185bc70a9` into `02b0c3af56`	2024-07-25 15:18:20 -07:00
Takashi Iwai	02b0c3af56	aseqdump: Avoid OOB access with broken SysEx UMP packets UMP SysEx messages have length field to specify the contained data bytes, but they can be over the actual packet size. Add the proper size limit checks for avoiding the access overflow. Signed-off-by: Takashi Iwai <tiwai@suse.de>	2024-07-24 14:05:55 +02:00
Takashi Iwai	df736ad67a	aseqdump: Support of UMP 8-bit SysEx messages Add the support to dump UMP 8-bit SysEx messages. A slight code refactoring to share the code snippet between 7bit and 8bit SysEx handling, too. Signed-off-by: Takashi Iwai <tiwai@suse.de>	2024-07-24 13:59:05 +02:00
Peter Ujfalusi	2185bc70a9	aplay: Print '=== PAUSE ===' only if it is supported Instead of printing the '=== PAUSE ===' unconditionally before calling do_pause(), move it to the function and only print it if the stream can be paused. If the stream cannot be paused that the '=== PAUSE ===' will be replaced by `PAUSE command ignored (no hw support)` immediately, which is not observable by users but automation scripts will catch the '=== PAUSE ===' and might think that the stream is indeed got paused. Move the print into do_pause() function after the snd_pcm_pause() have returned without error to make sure it is only printed if the stream is paused and we are waiting for the pause release from user to proceed. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>	2024-07-22 09:03:00 +03:00