Philippe Mathieu-Daudé a2cd86a94a hw/audio/sb16: Avoid assertion by restricting I/O sampling rate range ... While the SB16 seems to work up to 48000 Hz, the "Sound Blaster Series Hardware Programming Guide" limit the sampling range from 4000 Hz to 44100 Hz (Section 3-9, 3-10: Digitized Sound I/O Programming, tables 3-2 and 3-3). Later, section 6-15 (DSP Commands) is more specific regarding the 41h / 42h registers (Set digitized sound output sampling rate): Valid sampling rates range from 5000 to 45000 Hz inclusive. There is no comment regarding error handling if the register is filled with an out-of-range value. (See also section 3-28 "8-bit or 16-bit Auto-initialize Transfer"). Assume limits are enforced in hardware. This fixes triggering an assertion in audio_calloc(): #1 abort #2 audio_bug audio/audio.c:119:9 #3 audio_calloc audio/audio.c:154:9 #4 audio_pcm_sw_alloc_resources_out audio/audio_template.h:116:15 #5 audio_pcm_sw_init_out audio/audio_template.h:175:11 #6 audio_pcm_create_voice_pair_out audio/audio_template.h:410:9 #7 AUD_open_out audio/audio_template.h:503:14 #8 continue_dma8 hw/audio/sb16.c:216:20 #9 dma_cmd8 hw/audio/sb16.c:276:5 #10 command hw/audio/sb16.c:0 #11 dsp_write hw/audio/sb16.c:949:13 #12 portio_write softmmu/ioport.c:205:13 #13 memory_region_write_accessor softmmu/memory.c:491:5 #14 access_with_adjusted_size softmmu/memory.c:552:18 #15 memory_region_dispatch_write softmmu/memory.c:0:13 #16 flatview_write_continue softmmu/physmem.c:2759:23 #17 flatview_write softmmu/physmem.c:2799:14 #18 address_space_write softmmu/physmem.c:2891:18 #19 cpu_outw softmmu/ioport.c:70:5 [*] http://www.baudline.com/solutions/full_duplex/sb16_pci/index.html OSS-Fuzz Report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29174 Fixes: 85571bc741 ("audio merge (malc)") Buglink: https://bugs.launchpad.net/bugs/1910603 Tested-by: Qiang Liu <cyruscyliu@gmail.com> Reviewed-by: Qiang Liu <cyruscyliu@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20210616104349.2398060-1-f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>		2021-06-17 11:55:23 +02:00
..
acceptance	tests/acceptance: tag various arm tests as TCG only	2021-06-07 14:42:47 +01:00
bench
data
decode	decodetree: Extend argument set syntax to allow types	2021-05-01 11:45:35 -07:00
docker	* Update the references to some doc files (use *.rst instead of *.txt)	2021-06-02 17:08:11 +01:00
fp	tests/fp: Enable more tests	2021-06-03 14:09:03 -07:00
guest-debug
image-fuzzer
include
keys
migration	tests/migration: introduce multifd into guestperf	2021-05-13 18:21:14 +01:00
multiboot
perf/block/qcow2
plugin	plugins/syscall: Added a table-like summary output	2021-05-25 16:52:50 +01:00
qapi-schema	docs: fix references to docs/devel/build-system.rst	2021-06-02 06:51:09 +02:00
qemu-iotests	Block layer patches	2021-06-02 19:34:03 +01:00
qtest	hw/audio/sb16: Avoid assertion by restricting I/O sampling rate range	2021-06-17 11:55:23 +02:00
rocker
tcg	target/arm: Fix mte page crossing test	2021-06-16 14:33:51 +01:00
tsan
uefi-test-tools
unit	tests/unit/test-vmstate: Assert that dup() and mkstemp() succeed	2021-06-03 16:43:27 +01:00
vm	tests/vm: expose --source-path to scripts to find extra files	2021-06-07 14:42:47 +01:00
vmstate-static-checker-data
check-block.sh
dbus-vmstate-daemon.sh
Makefile.include
meson.build
requirements.txt	acceptance tests: bump Avocado version to 88.1	2021-06-01 16:21:21 -04:00
test-qht-par.c
vhost-user-bridge.c