tag | e234f02fad2391f131c35232a7143396d452c83b | |
---|---|---|
tagger | The Android Open Source Project <initial-contribution@android.com> | Wed Mar 28 16:50:33 2018 -0700 |
object | 2dbf7df6996e5f0b00131dd1da3ee0e922f8120c |
Android Wear 8.0.0 Release 0.20 (OWDE.180215.017,sawshark)
commit | 2dbf7df6996e5f0b00131dd1da3ee0e922f8120c | [log] [tgz] |
---|---|---|
author | y00230200 <yanghongliang.yang@huawei.com> | Thu Jan 18 17:08:24 2018 +0800 |
committer | Hongliang Yang <yanghongliang.yang@huawei.com> | Sat Jan 27 09:09:03 2018 +0000 |
tree | 0c471177ccbd3b1e95a2795fc345f4c9a5c3642d | |
parent | fc750ea71a597c6426ff563a9caf47db9cf090a4 [diff] |
ALSA: seq: Fix use-after-free at creating a port CVE-2017-15265 There is a potential race window opened at creating and deleting a port via ioctl, as spotted by fuzzing. snd_seq_create_port() creates a port object and returns its pointer, but it doesn't take the refcount, thus it can be deleted immediately by another thread.