diff options
| author | Eliot Blennerhassett <eblennerhassett@audioscience.com> | 2011-08-01 23:44:24 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2011-08-02 09:26:31 +0200 |
| commit | 08f984c7f7f569b66acbbd163676b4bc7f64addc (patch) | |
| tree | 333d7e308511ba0a3f47c9129a065f3603a52772 /sound | |
| parent | ALSA: asihpi - Don't leak firmware if mem alloc fails (diff) | |
| download | linux-08f984c7f7f569b66acbbd163676b4bc7f64addc.tar.xz linux-08f984c7f7f569b66acbbd163676b4bc7f64addc.zip | |
ALSA: asihpi - Clarify adapter index validity check
Avoids assigning possibly invalid address to pa, even if it
is never dereferenced.
Correct error response to reflect request object/function ids.
Signed-off-by: Eliot Blennerhassett <eblennerhassett@audioscience.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/pci/asihpi/hpioctl.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c index 9683f84ecdc8..a32502e796de 100644 --- a/sound/pci/asihpi/hpioctl.c +++ b/sound/pci/asihpi/hpioctl.c @@ -177,16 +177,21 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) } else { u16 __user *ptr = NULL; u32 size = 0; - + u32 adapter_present; /* -1=no data 0=read from user mem, 1=write to user mem */ int wrflag = -1; - u32 adapter = hm->h.adapter_index; - struct hpi_adapter *pa = &adapters[adapter]; + struct hpi_adapter *pa; + + if (hm->h.adapter_index < HPI_MAX_ADAPTERS) { + pa = &adapters[hm->h.adapter_index]; + adapter_present = pa->type; + } else { + adapter_present = 0; + } - if ((adapter >= HPI_MAX_ADAPTERS) || (!pa->type)) { - hpi_init_response(&hr->r0, HPI_OBJ_ADAPTER, - HPI_ADAPTER_OPEN, - HPI_ERROR_BAD_ADAPTER_NUMBER); + if (!adapter_present) { + hpi_init_response(&hr->r0, hm->h.object, + hm->h.function, HPI_ERROR_BAD_ADAPTER_NUMBER); uncopied_bytes = copy_to_user(puhr, hr, sizeof(hr->h)); |