public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ALSA: echoaudio: read past end of array

Browse source 
We need to cap "ucontrol->id.index / num_busses_in(chip)" so the we
don't read beyond the end of the array.

I also adding a check on "in" and changing the type in
snd_echo_mixer_put() from short to unsigned int. Those changes are done
for symmetry and are cosmetic.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Dan Carpenter 2015-03-23 12:41:31 +03:00 • committed by Takashi Iwai
parent 034f90b393
commit 77008b70fe
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
sound/pci/echoaudio/echoaudio.c
View file

@ -1283,12 +1283,14 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol,
static int snd_echo_mixer_get(struct snd_kcontrol *kcontrol, static int snd_echo_mixer_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol) struct snd_ctl_elem_value *ucontrol)
{ {
struct echoaudio *chip; struct echoaudio *chip = snd_kcontrol_chip(kcontrol);
unsigned int out = ucontrol->id.index / num_busses_in(chip);
unsigned int in = ucontrol->id.index % num_busses_in(chip);
chip = snd_kcontrol_chip(kcontrol); if (out >= ECHO_MAXAUDIOOUTPUTS || in >= ECHO_MAXAUDIOINPUTS)
ucontrol->value.integer.value[0] = return -EINVAL;
chip->monitor_gain[ucontrol->id.index / num_busses_in(chip)]
[ucontrol->id.index % num_busses_in(chip)]; ucontrol->value.integer.value[0] = chip->monitor_gain[out][in];
return 0; return 0;
} }
@ -1297,12 +1299,14 @@ static int snd_echo_mixer_put(struct snd_kcontrol *kcontrol,
{ {
struct echoaudio *chip; struct echoaudio *chip;
int changed, gain; int changed, gain;
short out, in; unsigned int out, in;
changed = 0; changed = 0;
chip = snd_kcontrol_chip(kcontrol); chip = snd_kcontrol_chip(kcontrol);
out = ucontrol->id.index / num_busses_in(chip); out = ucontrol->id.index / num_busses_in(chip);
in = ucontrol->id.index % num_busses_in(chip); in = ucontrol->id.index % num_busses_in(chip);
if (out >= ECHO_MAXAUDIOOUTPUTS || in >= ECHO_MAXAUDIOINPUTS)
return -EINVAL;
gain = ucontrol->value.integer.value[0]; gain = ucontrol->value.integer.value[0];
if (gain < ECHOGAIN_MINOUT || gain > ECHOGAIN_MAXOUT) if (gain < ECHOGAIN_MINOUT || gain > ECHOGAIN_MAXOUT)
return -EINVAL; return -EINVAL;