diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-02-11 16:10:54 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2015-02-12 11:07:48 +0100 |
| commit | 0b444af8daf9cd28264aa3c85587c0c8601208ba (patch) | |
| tree | 01353e05006eb7871b530cc7928fb7f5eca8cdd5 /sound | |
| parent | ALSA: line6: Improve line6_read/write_data() interfaces (diff) | |
| download | linux-0b444af8daf9cd28264aa3c85587c0c8601208ba.tar.xz linux-0b444af8daf9cd28264aa3c85587c0c8601208ba.zip | |
ALSA: seq: potential out of bounds in do_control()
Smatch complains that "control" is user specifigy and needs to be
capped. The call tree to understand this warning is quite long.
snd_seq_write() <-- get the event from the user
snd_seq_client_enqueue_event()
snd_seq_deliver_event()
deliver_to_subscribers()
snd_seq_deliver_single_event()
snd_opl3_oss_event_input()
snd_midi_process_event()
do_control()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/seq/seq_midi_emul.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sound/core/seq/seq_midi_emul.c b/sound/core/seq/seq_midi_emul.c index 9b6470cdcf24..7ba937399ac7 100644 --- a/sound/core/seq/seq_midi_emul.c +++ b/sound/core/seq/seq_midi_emul.c @@ -269,6 +269,9 @@ do_control(struct snd_midi_op *ops, void *drv, struct snd_midi_channel_set *chse { int i; + if (control >= ARRAY_SIZE(chan->control)) + return; + /* Switches */ if ((control >=64 && control <=69) || (control >= 80 && control <= 83)) { /* These are all switches; either off or on so set to 0 or 127 */ |