fix a potential local DoS attack

2 files changed, 13 insertions, 2 deletions

diff --git a/sys/dev/sound/pcm/channel.c b/sys/dev/sound/pcm/channel.c
index cb2c9e5..23d3232 100644
--- a/sys/dev/sound/pcm/channel.c
+++ b/sys/dev/sound/pcm/channel.c
@@ -547,8 +547,19 @@ static int
 chn_rddump(pcm_channel *c, int cnt)
 {
     	snd_dbuf *b = &c->buffer;
+	int maxover, ss;
 
-	printf("overrun, dumping %d bytes\n", cnt);
+	ss = 1;
+	ss <<= (b->fmt & AFMT_STEREO)? 1 : 0;
+	ss <<= (b->fmt & AFMT_16BIT)? 1 : 0;
+	maxover = c->speed * ss;
+
+	b->overrun += cnt;
+	if (b->overrun > maxover) {
+		device_printf(c->parent->dev, "record overrun, dumping %d bytes\n",
+			b->overrun);
+		b->overrun = 0;
+	}
 	b->rl -= cnt;
 	b->fl += cnt;
 	b->rp = (b->rp + cnt) % b->bufsize;
diff --git a/sys/dev/sound/pcm/datatypes.h b/sys/dev/sound/pcm/datatypes.h
index 31df62b..986829a0 100644
--- a/sys/dev/sound/pcm/datatypes.h
+++ b/sys/dev/sound/pcm/datatypes.h
@@ -67,7 +67,7 @@ struct _snd_dbuf {
 	volatile u_int32_t total, prev_total;
 	int chan, dir;       /* dma channel */
 	int fmt, blksz, blkcnt;
-	int underflow;
+	int underflow, overrun;
 	bus_dmamap_t dmamap;
 	struct selinfo sel;
 };