Re: malloc calls and ioctl calls to soundcard cause segfault

2004-10-13 Thread Dan Nelson
In the last episode (Oct 14), Shawn Webb said: > I've got to rewrite the source due to hard disk problems, so I'll just put > it in this email: > > arg = FORMAT; > if (ioctl(fd, SNDCTL_DSP_SETFMT, &arg) < 0) > { > perror("ioctl setfmt"); > exit(1); > } > > if (

RE: malloc calls and ioctl calls to soundcard cause segfault

2004-10-13 Thread Shawn Webb
s"); exit(1); } arg = RATE; if (ioctl(fd, SNDCTL_DSP_SETRATE, &arg) < 0) { perror("ioctl setrate"); exit(1); } } /* End of source */ - Original Message - From: "Robert Watson" <[EMAIL PROTECTED]> To: "S

Re: malloc calls and ioctl calls to soundcard cause segfault

2004-10-13 Thread Robert Watson
On Tue, 12 Oct 2004, Shawn Webb wrote: > (attached is the source code to the segfaulting application) Doesn't appear to be -- if it was a large attachment, maybe the mailing list stripped it. Could you give a URL for the source? Robert N M Watson FreeBSD Core Team, TrustedBSD Proj

malloc calls and ioctl calls to soundcard cause segfault

2004-10-12 Thread Shawn Webb
I have stumbled upon a local DoS (non-kernel) while writing a VoIP app for FreeBSD. The DoS exists when two ioctl calls (or less/more?) are followed by a malloc call to malloc a pointer in global scope which is then followed by two more (or less/more?) ioctl calls. The result is a stack smash, a