summaryrefslogtreecommitdiff
path: root/sound/core
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2015-02-11 18:10:54 +0300
committerTakashi Iwai <tiwai@suse.de>2015-02-12 13:07:48 +0300
commit0b444af8daf9cd28264aa3c85587c0c8601208ba (patch)
tree01353e05006eb7871b530cc7928fb7f5eca8cdd5 /sound/core
parent25a0707cf6bc20677aa2e0b889d69f9dee8c1f14 (diff)
downloadlinux-0b444af8daf9cd28264aa3c85587c0c8601208ba.tar.xz
ALSA: seq: potential out of bounds in do_control()
Smatch complains that "control" is user specifigy and needs to be capped. The call tree to understand this warning is quite long. snd_seq_write() <-- get the event from the user snd_seq_client_enqueue_event() snd_seq_deliver_event() deliver_to_subscribers() snd_seq_deliver_single_event() snd_opl3_oss_event_input() snd_midi_process_event() do_control() Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core')
-rw-r--r--sound/core/seq/seq_midi_emul.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/sound/core/seq/seq_midi_emul.c b/sound/core/seq/seq_midi_emul.c
index 9b6470cdcf24..7ba937399ac7 100644
--- a/sound/core/seq/seq_midi_emul.c
+++ b/sound/core/seq/seq_midi_emul.c
@@ -269,6 +269,9 @@ do_control(struct snd_midi_op *ops, void *drv, struct snd_midi_channel_set *chse
{
int i;
+ if (control >= ARRAY_SIZE(chan->control))
+ return;
+
/* Switches */
if ((control >=64 && control <=69) || (control >= 80 && control <= 83)) {
/* These are all switches; either off or on so set to 0 or 127 */