redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ALSA: echoaudio: read past end of array 

We need to cap "ucontrol->id.index / num_busses_in(chip)" so the we
don't read beyond the end of the array.

I also adding a check on "in" and changing the type in
snd_echo_mixer_put() from short to unsigned int. Those changes are done
for symmetry and are cosmetic.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
hifive-unleashed-5.1
Dan Carpenter 2015-03-23 12:41:31 +03:00 committed by Takashi Iwai
parent 034f90b393
commit 77008b70fe
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sound/pci/echoaudio/echoaudio.c
View File

@ -1283,12 +1283,14 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol,
static int snd_echo_mixer_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol)
{
struct echoaudio *chip;
struct echoaudio *chip = snd_kcontrol_chip(kcontrol);
unsigned int out = ucontrol->id.index / num_busses_in(chip);
unsigned int in = ucontrol->id.index % num_busses_in(chip);
chip = snd_kcontrol_chip(kcontrol);
ucontrol->value.integer.value[0] =
chip->monitor_gain[ucontrol->id.index / num_busses_in(chip)]
[ucontrol->id.index % num_busses_in(chip)];
if (out >= ECHO_MAXAUDIOOUTPUTS || in >= ECHO_MAXAUDIOINPUTS)
return -EINVAL;
ucontrol->value.integer.value[0] = chip->monitor_gain[out][in];
return 0;
}
@ -1297,12 +1299,14 @@ static int snd_echo_mixer_put(struct snd_kcontrol *kcontrol,
{
struct echoaudio *chip;
int changed, gain;
short out, in;
unsigned int out, in;
changed = 0;
chip = snd_kcontrol_chip(kcontrol);
out = ucontrol->id.index / num_busses_in(chip);
in = ucontrol->id.index % num_busses_in(chip);
if (out >= ECHO_MAXAUDIOOUTPUTS || in >= ECHO_MAXAUDIOINPUTS)
return -EINVAL;
gain = ucontrol->value.integer.value[0];
if (gain < ECHOGAIN_MINOUT || gain > ECHOGAIN_MAXOUT)
return -EINVAL;