Memory corruption on unsupported ALSA channel count (with patch)

MS
Michael Scheiffler
Wed, Oct 4, 2017 10:03 AM

Hi there,

I found a quite severe bug in the source file pjmedia_audiodev/alsa_dev.c.

I wanted to configure a sound device in mono mode, but it seems that
my device isn't capable of that. As a consequence, the call to
snd_pcm_hw_params_set_channels() failed and returned -22.
Currently this return code isn't checked at all. Instead the
initialization continues just normally.

In my case, buffers for mono audio were allocated but the device
delivered stereo audio instead. This caused a severe memory
corruption, which was kinda hard to debug since it originated from the
kernel code (where my watchpoints didn't work).

Attached you can find a patch which reports an error in case the sound
device doesn't support the desired channel count.

Please integrate.
Many thanks in advance.

Regards,
Michael

Hi there, I found a quite severe bug in the source file pjmedia_audiodev/alsa_dev.c. I wanted to configure a sound device in mono mode, but it seems that my device isn't capable of that. As a consequence, the call to snd_pcm_hw_params_set_channels() failed and returned -22. Currently this return code isn't checked at all. Instead the initialization continues just normally. In my case, buffers for mono audio were allocated but the device delivered stereo audio instead. This caused a severe memory corruption, which was kinda hard to debug since it originated from the kernel code (where my watchpoints didn't work). Attached you can find a patch which reports an error in case the sound device doesn't support the desired channel count. Please integrate. Many thanks in advance. Regards, Michael