* [patch] ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()
@ 2013-09-13 7:52 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2013-09-13 7:52 UTC (permalink / raw)
To: Liam Girdwood
Cc: Mark Brown, Jaroslav Kysela, Takashi Iwai, Bill Pemberton,
Lars-Peter Clausen, Sachin Kamat, alsa-devel, kernel-janitors
This is called from snd_ctl_elem_write() with user supplied data so we
need to add some bounds checking.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 8af0434..259d1ac 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -349,6 +349,9 @@ static int snd_soc_put_volsw_2r_st(struct snd_kcontrol *kcontrol,
val = ucontrol->value.integer.value[0];
val2 = ucontrol->value.integer.value[1];
+ if (val >= ARRAY_SIZE(st_table) || val2 >= ARRAY_SIZE(st_table))
+ return -EINVAL;
+
err = snd_soc_update_bits(codec, reg, 0x3f, st_table[val].m);
if (err < 0)
return err;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()
@ 2013-09-13 7:52 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2013-09-13 7:52 UTC (permalink / raw)
To: Liam Girdwood
Cc: Mark Brown, Jaroslav Kysela, Takashi Iwai, Bill Pemberton,
Lars-Peter Clausen, Sachin Kamat, alsa-devel, kernel-janitors
This is called from snd_ctl_elem_write() with user supplied data so we
need to add some bounds checking.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index 8af0434..259d1ac 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -349,6 +349,9 @@ static int snd_soc_put_volsw_2r_st(struct snd_kcontrol *kcontrol,
val = ucontrol->value.integer.value[0];
val2 = ucontrol->value.integer.value[1];
+ if (val >= ARRAY_SIZE(st_table) || val2 >= ARRAY_SIZE(st_table))
+ return -EINVAL;
+
err = snd_soc_update_bits(codec, reg, 0x3f, st_table[val].m);
if (err < 0)
return err;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()
2013-09-13 7:52 ` Dan Carpenter
@ 2013-09-13 17:34 ` Mark Brown
-1 siblings, 0 replies; 4+ messages in thread
From: Mark Brown @ 2013-09-13 17:34 UTC (permalink / raw)
To: Dan Carpenter
Cc: Liam Girdwood, Jaroslav Kysela, Takashi Iwai, Bill Pemberton,
Lars-Peter Clausen, Sachin Kamat, alsa-devel, kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 190 bytes --]
On Fri, Sep 13, 2013 at 10:52:49AM +0300, Dan Carpenter wrote:
> This is called from snd_ctl_elem_write() with user supplied data so we
> need to add some bounds checking.
Applied, thanks.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st()
@ 2013-09-13 17:34 ` Mark Brown
0 siblings, 0 replies; 4+ messages in thread
From: Mark Brown @ 2013-09-13 17:34 UTC (permalink / raw)
To: Dan Carpenter
Cc: Liam Girdwood, Jaroslav Kysela, Takashi Iwai, Bill Pemberton,
Lars-Peter Clausen, Sachin Kamat, alsa-devel, kernel-janitors
[-- Attachment #1: Type: text/plain, Size: 190 bytes --]
On Fri, Sep 13, 2013 at 10:52:49AM +0300, Dan Carpenter wrote:
> This is called from snd_ctl_elem_write() with user supplied data so we
> need to add some bounds checking.
Applied, thanks.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-09-13 17:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-13 7:52 [patch] ASoC: 88pm860x: array overflow in snd_soc_put_volsw_2r_st() Dan Carpenter
2013-09-13 7:52 ` Dan Carpenter
2013-09-13 17:34 ` Mark Brown
2013-09-13 17:34 ` Mark Brown
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.