* [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()
@ 2019-01-25 12:44 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2019-01-25 12:44 UTC (permalink / raw)
To: Clemens Ladisch, Takashi Sakamoto
Cc: alsa-devel, kernel-janitors, Takashi Iwai
The > should be >= or otherwise we potentially read one element beyond
the end of the ff->tx_midi_substreams[] array.
Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
sound/firewire/fireface/ff-protocol-latter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
index 817af4447349..438aeed9a1ab 100644
--- a/sound/firewire/fireface/ff-protocol-latter.c
+++ b/sound/firewire/fireface/ff-protocol-latter.c
@@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
struct snd_rawmidi_substream *substream;
unsigned int len;
- if (index > ff->spec->midi_in_ports)
+ if (index >= ff->spec->midi_in_ports)
return;
switch (data & 0x0000000f) {
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()
@ 2019-01-25 12:44 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2019-01-25 12:44 UTC (permalink / raw)
To: Clemens Ladisch, Takashi Sakamoto
Cc: alsa-devel, kernel-janitors, Takashi Iwai
The > should be >= or otherwise we potentially read one element beyond
the end of the ff->tx_midi_substreams[] array.
Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
sound/firewire/fireface/ff-protocol-latter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
index 817af4447349..438aeed9a1ab 100644
--- a/sound/firewire/fireface/ff-protocol-latter.c
+++ b/sound/firewire/fireface/ff-protocol-latter.c
@@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
struct snd_rawmidi_substream *substream;
unsigned int len;
- if (index > ff->spec->midi_in_ports)
+ if (index >= ff->spec->midi_in_ports)
return;
switch (data & 0x0000000f) {
--
2.17.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()
2019-01-25 12:44 ` Dan Carpenter
@ 2019-01-25 13:41 ` Takashi Sakamoto
-1 siblings, 0 replies; 6+ messages in thread
From: Takashi Sakamoto @ 2019-01-25 13:41 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Clemens Ladisch, alsa-devel, kernel-janitors, Takashi Iwai
On Fri, Jan 25, 2019 at 03:44:18PM +0300, Dan Carpenter wrote:
> The > should be >= or otherwise we potentially read one element beyond
> the end of the ff->tx_midi_substreams[] array.
>
> Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> sound/firewire/fireface/ff-protocol-latter.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
> index 817af4447349..438aeed9a1ab 100644
> --- a/sound/firewire/fireface/ff-protocol-latter.c
> +++ b/sound/firewire/fireface/ff-protocol-latter.c
> @@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
> struct snd_rawmidi_substream *substream;
> unsigned int len;
>
> - if (index > ff->spec->midi_in_ports)
> + if (index >= ff->spec->midi_in_ports)
> return;
>
> switch (data & 0x0000000f) {
> --
> 2.17.1
Indeed. The value of index is picked up from quadlet data transferred by
device. The range of value is expected to be 0x00 or 0x01, thus this patch is
correct.
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Thanks
Takashi Sakamoto
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()
@ 2019-01-25 13:41 ` Takashi Sakamoto
0 siblings, 0 replies; 6+ messages in thread
From: Takashi Sakamoto @ 2019-01-25 13:41 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Clemens Ladisch, alsa-devel, kernel-janitors, Takashi Iwai
On Fri, Jan 25, 2019 at 03:44:18PM +0300, Dan Carpenter wrote:
> The > should be >= or otherwise we potentially read one element beyond
> the end of the ff->tx_midi_substreams[] array.
>
> Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> sound/firewire/fireface/ff-protocol-latter.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
> index 817af4447349..438aeed9a1ab 100644
> --- a/sound/firewire/fireface/ff-protocol-latter.c
> +++ b/sound/firewire/fireface/ff-protocol-latter.c
> @@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
> struct snd_rawmidi_substream *substream;
> unsigned int len;
>
> - if (index > ff->spec->midi_in_ports)
> + if (index >= ff->spec->midi_in_ports)
> return;
>
> switch (data & 0x0000000f) {
> --
> 2.17.1
Indeed. The value of index is picked up from quadlet data transferred by
device. The range of value is expected to be 0x00 or 0x01, thus this patch is
correct.
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Thanks
Takashi Sakamoto
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()
2019-01-25 13:41 ` Takashi Sakamoto
@ 2019-01-25 14:52 ` Takashi Iwai
-1 siblings, 0 replies; 6+ messages in thread
From: Takashi Iwai @ 2019-01-25 14:52 UTC (permalink / raw)
To: Takashi Sakamoto
Cc: kernel-janitors, alsa-devel, Clemens Ladisch, Dan Carpenter
On Fri, 25 Jan 2019 14:41:39 +0100,
Takashi Sakamoto wrote:
>
> On Fri, Jan 25, 2019 at 03:44:18PM +0300, Dan Carpenter wrote:
> > The > should be >= or otherwise we potentially read one element beyond
> > the end of the ff->tx_midi_substreams[] array.
> >
> > Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > sound/firewire/fireface/ff-protocol-latter.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
> > index 817af4447349..438aeed9a1ab 100644
> > --- a/sound/firewire/fireface/ff-protocol-latter.c
> > +++ b/sound/firewire/fireface/ff-protocol-latter.c
> > @@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
> > struct snd_rawmidi_substream *substream;
> > unsigned int len;
> >
> > - if (index > ff->spec->midi_in_ports)
> > + if (index >= ff->spec->midi_in_ports)
> > return;
> >
> > switch (data & 0x0000000f) {
> > --
> > 2.17.1
>
> Indeed. The value of index is picked up from quadlet data transferred by
> device. The range of value is expected to be 0x00 or 0x01, thus this patch is
> correct.
>
> Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Applied now. Thanks.
Takashi
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()
@ 2019-01-25 14:52 ` Takashi Iwai
0 siblings, 0 replies; 6+ messages in thread
From: Takashi Iwai @ 2019-01-25 14:52 UTC (permalink / raw)
To: Takashi Sakamoto
Cc: kernel-janitors, alsa-devel, Clemens Ladisch, Dan Carpenter
On Fri, 25 Jan 2019 14:41:39 +0100,
Takashi Sakamoto wrote:
>
> On Fri, Jan 25, 2019 at 03:44:18PM +0300, Dan Carpenter wrote:
> > The > should be >= or otherwise we potentially read one element beyond
> > the end of the ff->tx_midi_substreams[] array.
> >
> > Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > sound/firewire/fireface/ff-protocol-latter.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
> > index 817af4447349..438aeed9a1ab 100644
> > --- a/sound/firewire/fireface/ff-protocol-latter.c
> > +++ b/sound/firewire/fireface/ff-protocol-latter.c
> > @@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
> > struct snd_rawmidi_substream *substream;
> > unsigned int len;
> >
> > - if (index > ff->spec->midi_in_ports)
> > + if (index >= ff->spec->midi_in_ports)
> > return;
> >
> > switch (data & 0x0000000f) {
> > --
> > 2.17.1
>
> Indeed. The value of index is picked up from quadlet data transferred by
> device. The range of value is expected to be 0x00 or 0x01, thus this patch is
> correct.
>
> Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Applied now. Thanks.
Takashi
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-01-25 14:52 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-01-25 12:44 [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg() Dan Carpenter
2019-01-25 12:44 ` Dan Carpenter
2019-01-25 13:41 ` Takashi Sakamoto
2019-01-25 13:41 ` Takashi Sakamoto
2019-01-25 14:52 ` Takashi Iwai
2019-01-25 14:52 ` Takashi Iwai
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.