Heap OOB write in seq_open when more than 32 MIDI devices registered
Summary
seq_open at sequencer.c:772: loop bounded by maxunits from midimapper_open (live count of midi_devs, no cap). midis[32]/midi_flags[32] fixed arrays. midi_number>=32 -> OOB write past allocations. Requires 33+ MIDI devices (privileged driver attach). Fix: clamp maxunits to 32.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1394 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 774 B | ↓ raw |
DF-1394 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Heap OOB write in seq_open when more than 32 MIDI devices registered
Source Location
sys/dev/sound/midi/sequencer.c:541-780
Verdict
Source-confirmed (complex fix): Heap OOB write in seq_open when more than 32 MIDI devices registered. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
seq_open at sequencer.c:772: loop bounded by maxunits from midimapper_open (live count of midi_devs, no cap). midis[32]/midi_flags[32] fixed arrays. midi_number>=32 -> OOB write past allocations. Requires 33+ MIDI devices (privileged driver attach). Fix: clamp maxunits to 32.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: seq_open allocates fixed 32-entry midis/midi_flags arrays but no limit on registered MIDI device count, OOB heap write if >32 devices. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: seq_open allocates fixed 32-entry midis/midi_flags arrays but no limit on registered MIDI device count, OOB heap write if >32 devices. Complex fix. HW-gated.
Verdict
Source-confirmed: seq_open allocates fixed 32-entry midis/midi_flags arrays but no limit on registered MIDI device count, OOB heap write if >32 devices. Complex fix. HW-gated.
No comments yet.