diff options
| author | Artem Egorkine <arteme@gmail.com> | 2022-12-25 13:57:28 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-14 12:16:27 +0300 |
| commit | 66f359ad66d49f75d39ac729f9114dabf90b81bb (patch) | |
| tree | 7f594496c3693af36f27f45ca6ec77b6f5bf7e1a /sound/usb | |
| parent | 5e79f77ea42fdc7dc147f640cbc2c925b318954e (diff) | |
| download | linux-66f359ad66d49f75d39ac729f9114dabf90b81bb.tar.xz | |
ALSA: line6: fix stack overflow in line6_midi_transmit
commit b8800d324abb50160560c636bfafe2c81001b66c upstream.
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are sent to a PODxt device.
Signed-off-by: Artem Egorkine <arteme@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20221225105728.1153989-2-arteme@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/usb')
| -rw-r--r-- | sound/usb/line6/midi.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c index d52355de2bbc..0838632c788e 100644 --- a/sound/usb/line6/midi.c +++ b/sound/usb/line6/midi.c @@ -44,7 +44,8 @@ static void line6_midi_transmit(struct snd_rawmidi_substream *substream) int req, done; for (;;) { - req = min(line6_midibuf_bytes_free(mb), line6->max_packet_size); + req = min3(line6_midibuf_bytes_free(mb), line6->max_packet_size, + LINE6_FALLBACK_MAXPACKETSIZE); done = snd_rawmidi_transmit_peek(substream, chunk, req); if (done == 0) |