summaryrefslogtreecommitdiff
path: root/sound/drivers
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2015-03-05 20:49:06 +0300
committerTakashi Iwai <tiwai@suse.de>2015-03-06 15:04:42 +0300
commitd124380674b58f62d0ef974630d74d67bb8afeb0 (patch)
tree62b34be40785bf00659a881f1ef2cb01daaa376a /sound/drivers
parentf44f07cf3910f84b15b2a78c4933d5946bf409cf (diff)
downloadlinux-d124380674b58f62d0ef974630d74d67bb8afeb0.tar.xz
ALSA: opl3: small array underflow
There is a missing lower bound check on "pitchbend" so it means we can read up to 6 elements before the start of the opl3_note_table[] array. Thanks to Clemens Ladisch for his help with this patch. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/drivers')
-rw-r--r--sound/drivers/opl3/opl3_midi.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
index f62780ed64ad..7821b07415a7 100644
--- a/sound/drivers/opl3/opl3_midi.c
+++ b/sound/drivers/opl3/opl3_midi.c
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,
int pitchbend = chan->midi_pitchbend;
int segment;
+ if (pitchbend < -0x2000)
+ pitchbend = -0x2000;
if (pitchbend > 0x1FFF)
pitchbend = 0x1FFF;