Skip to content

Commit

Permalink
ALSA: seq: potential out of bounds in do_control()
Browse files Browse the repository at this point in the history
Smatch complains that "control" is user specifigy and needs to be
capped.  The call tree to understand this warning is quite long.

snd_seq_write()  <-- get the event from the user
  snd_seq_client_enqueue_event()
    snd_seq_deliver_event()
      deliver_to_subscribers()
        snd_seq_deliver_single_event()
          snd_opl3_oss_event_input()
            snd_midi_process_event()
              do_control()

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Dan Carpenter authored and Takashi Iwai committed Feb 12, 2015
1 parent 25a0707 commit 0b444af
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions sound/core/seq/seq_midi_emul.c
Original file line number Diff line number Diff line change
Expand Up @@ -269,6 +269,9 @@ do_control(struct snd_midi_op *ops, void *drv, struct snd_midi_channel_set *chse
{
int i;

if (control >= ARRAY_SIZE(chan->control))
return;

/* Switches */
if ((control >=64 && control <=69) || (control >= 80 && control <= 83)) {
/* These are all switches; either off or on so set to 0 or 127 */
Expand Down

0 comments on commit 0b444af

Please sign in to comment.