ossaudio: fix out of bounds write

In function oss_read() a read error currently does not exit the
read loop. With no data to read the variable pos will quickly
underflow and a subsequent successful read overwrites memory
outside the buffer. This patch adds the missing break statement
to the error path of the function.

To reproduce start qemu with -audiodev oss,id=audio0 and in the
guest start audio recording. After some time this will trigger
an exception.

Fixes: 3ba4066 "ossaudio: port to the new audio backend api"

Signed-off-by: Volker Rümelin <[email protected]>
Message-id: [email protected]
Signed-off-by: Gerd Hoffmann <[email protected]>

Author: Volker Rümelin

audio/ossaudio.c

@@ -691,6 +691,7 @@ static size_t oss_read(HWVoiceIn *hw, void *buf, size_t len)
                            len, dst);
                 break;
             }
+            break;
         }
 
         pos += nread;