Re: midiplay: Fix out-of-bounds memory access

2016-05-04 Thread Jonathan Gray
On Wed, May 04, 2016 at 02:01:57PM +0200, Alexandre Ratchov wrote: > On Sun, May 01, 2016 at 12:53:17PM +0300, Vadim Zhukov wrote: > > 2016-04-30 7:38 GMT+03:00 Jonathan Gray : > > > On Wed, Apr 27, 2016 at 07:49:50PM -0700, Geoff Hill wrote: > > >> Fix possible reads past the end of the buffer. >

Re: midiplay: Fix out-of-bounds memory access

2016-05-04 Thread Alexandre Ratchov
On Sun, May 01, 2016 at 12:53:17PM +0300, Vadim Zhukov wrote: > 2016-04-30 7:38 GMT+03:00 Jonathan Gray : > > On Wed, Apr 27, 2016 at 07:49:50PM -0700, Geoff Hill wrote: > >> Fix possible reads past the end of the buffer. > >> > >> Found by random fuzz testing (zzuf). Without the fix the fuzzer cra

Re: midiplay: Fix out-of-bounds memory access

2016-05-01 Thread Michael McConville
Vadim Zhukov wrote: > 2016-04-30 7:38 GMT+03:00 Jonathan Gray : > > On Wed, Apr 27, 2016 at 07:49:50PM -0700, Geoff Hill wrote: > >> Fix possible reads past the end of the buffer. > >> > >> Found by random fuzz testing (zzuf). Without the fix the fuzzer crashes > >> in several seconds; with the pat

Re: midiplay: Fix out-of-bounds memory access

2016-05-01 Thread Vadim Zhukov
2016-04-30 7:38 GMT+03:00 Jonathan Gray : > On Wed, Apr 27, 2016 at 07:49:50PM -0700, Geoff Hill wrote: >> Fix possible reads past the end of the buffer. >> >> Found by random fuzz testing (zzuf). Without the fix the fuzzer crashes >> in several seconds; with the patch, the fuzzer runs clean for ho

Re: midiplay: Fix out-of-bounds memory access

2016-04-29 Thread Geoff Hill
> Any reason to not replace the somewhat arbitary earlier test > for this? I chose to keep the condition simpler and the existing constraints intact for minimal impact, but I would agree it's better to consolidate with the existing check. Your diff looks good to me, +1.

Re: midiplay: Fix out-of-bounds memory access

2016-04-29 Thread Jonathan Gray
On Wed, Apr 27, 2016 at 07:49:50PM -0700, Geoff Hill wrote: > Fix possible reads past the end of the buffer. > > Found by random fuzz testing (zzuf). Without the fix the fuzzer crashes > in several seconds; with the patch, the fuzzer runs clean for hours. Any reason to not replace the somewhat ar

midiplay: Fix out-of-bounds memory access

2016-04-27 Thread Geoff Hill
Fix possible reads past the end of the buffer. Found by random fuzz testing (zzuf). Without the fix the fuzzer crashes in several seconds; with the patch, the fuzzer runs clean for hours. Index: midiplay.c === RCS file: /cvs/src/usr.