[qemu-xen master] ossaudio: fix out of bounds write

[patchbot@xxxxxxx]

commit 4f50d4a48e0caa1aad591f3ca437502e33b8699d
Author:     Volker Rümelin <vr_qemu@xxxxxxxxxxx>
AuthorDate: Tue Jul 7 20:08:36 2020 +0200
Commit:     Gerd Hoffmann <kraxel@xxxxxxxxxx>
CommitDate: Mon Jul 13 11:38:40 2020 +0200

    ossaudio: fix out of bounds write
    
    In function oss_read() a read error currently does not exit the
    read loop. With no data to read the variable pos will quickly
    underflow and a subsequent successful read overwrites memory
    outside the buffer. This patch adds the missing break statement
    to the error path of the function.
    
    To reproduce start qemu with -audiodev oss,id=audio0 and in the
    guest start audio recording. After some time this will trigger
    an exception.
    
    Fixes: 3ba4066d08 "ossaudio: port to the new audio backend api"
    
    Signed-off-by: Volker Rümelin <vr_qemu@xxxxxxxxxxx>
    Message-id: 20200707180836.5435-1-vr_qemu@xxxxxxxxxxx
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
---
 audio/ossaudio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index f88d076ec2..a7dcaa31ad 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -691,6 +691,7 @@ static size_t oss_read(HWVoiceIn *hw, void *buf, size_t len)
                            len, dst);
                 break;
             }
+            break;
         }
 
         pos += nread;
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master