Skip to content

Commit

Permalink
ALSA: asihpi - Clarify adapter index validity check
Browse files Browse the repository at this point in the history
Avoids assigning possibly invalid address to pa, even if it
is never dereferenced.
Correct error response to reflect request object/function ids.

Signed-off-by: Eliot Blennerhassett <eblennerhassett@audioscience.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Eliot Blennerhassett authored and Takashi Iwai committed Aug 2, 2011
1 parent dc889f1 commit 08f984c
Showing 1 changed file with 12 additions and 7 deletions.
19 changes: 12 additions & 7 deletions sound/pci/asihpi/hpioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -177,16 +177,21 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
} else {
u16 __user *ptr = NULL;
u32 size = 0;

u32 adapter_present;
/* -1=no data 0=read from user mem, 1=write to user mem */
int wrflag = -1;
u32 adapter = hm->h.adapter_index;
struct hpi_adapter *pa = &adapters[adapter];
struct hpi_adapter *pa;

if (hm->h.adapter_index < HPI_MAX_ADAPTERS) {
pa = &adapters[hm->h.adapter_index];
adapter_present = pa->type;
} else {
adapter_present = 0;
}

if ((adapter >= HPI_MAX_ADAPTERS) || (!pa->type)) {
hpi_init_response(&hr->r0, HPI_OBJ_ADAPTER,
HPI_ADAPTER_OPEN,
HPI_ERROR_BAD_ADAPTER_NUMBER);
if (!adapter_present) {
hpi_init_response(&hr->r0, hm->h.object,
hm->h.function, HPI_ERROR_BAD_ADAPTER_NUMBER);

uncopied_bytes =
copy_to_user(puhr, hr, sizeof(hr->h));
Expand Down

0 comments on commit 08f984c

Please sign in to comment.