mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
67 lines
2.1 KiB
Diff
67 lines
2.1 KiB
Diff
|
From 4dc040a0b34890d2adc0d63da6e9bfb4eb791b19 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Vinod Koul <vinod.koul@linux.intel.com>
|
||
|
|
Date: Mon, 17 Sep 2012 11:51:25 +0530
|
||
|
|
Subject: [PATCH] ALSA: compress - move the buffer check
|
||
|
|
|
||
|
|
Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()
|
||
|
|
added a new error check for input params.
|
||
|
|
this add new routine for input checks and moves buffer overflow check to this
|
||
|
|
new routine. This allows the error value to be propogated to user space
|
||
|
|
|
||
|
|
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
|
||
|
|
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
|
|
---
|
||
|
|
sound/core/compress_offload.c | 20 ++++++++++++++++----
|
||
|
|
1 file changed, 16 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
|
||
|
|
index 68fe02c7400a2..bd7f28e892540 100644
|
||
|
|
--- a/sound/core/compress_offload.c
|
||
|
|
+++ b/sound/core/compress_offload.c
|
||
|
|
@@ -407,10 +407,6 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
|
||
|
|
unsigned int buffer_size;
|
||
|
|
void *buffer;
|
||
|
|
|
||
|
|
- if (params->buffer.fragment_size == 0 ||
|
||
|
|
- params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
|
||
|
|
- return -EINVAL;
|
||
|
|
-
|
||
|
|
buffer_size = params->buffer.fragment_size * params->buffer.fragments;
|
||
|
|
if (stream->ops->copy) {
|
||
|
|
buffer = NULL;
|
||
|
|
@@ -429,6 +425,16 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
+static int snd_compress_check_input(struct snd_compr_params *params)
|
||
|
|
+{
|
||
|
|
+ /* first let's check the buffer parameter's */
|
||
|
|
+ if (params->buffer.fragment_size == 0 ||
|
||
|
|
+ params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
|
||
|
|
+ return -EINVAL;
|
||
|
|
+
|
||
|
|
+ return 0;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
static int
|
||
|
|
snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
|
||
|
|
{
|
||
|
|
@@ -447,11 +453,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
|
||
|
|
retval = -EFAULT;
|
||
|
|
goto out;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+ retval = snd_compress_check_input(params);
|
||
|
|
+ if (retval)
|
||
|
|
+ goto out;
|
||
|
|
+
|
||
|
|
retval = snd_compr_allocate_buffer(stream, params);
|
||
|
|
if (retval) {
|
||
|
|
retval = -ENOMEM;
|
||
|
|
goto out;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
retval = stream->ops->set_params(stream, params);
|
||
|
|
if (retval)
|
||
|
|
goto out;
|