diff options
author | Clemens Ladisch <clemens@ladisch.de> | 2010-02-22 04:45:07 -0500 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-02-26 13:11:03 -0500 |
commit | cca80b973244cf7cf721b05b33178ba4826dbc5e (patch) | |
tree | f16bab60afa956efb19a1437e50c5700ff529a49 /drivers/media/video | |
parent | 071193ff4182c8f785e770c54e35f3ea2bb98b84 (diff) |
V4L/DVB: cx88-alsa: prevent out-of-range volume setting
Ensure that volume values are always in the allowed range. Otherwise,
it would be possible to set other bits in the AUD_VOL_CTL register or to
get a wrong sign in the AUD_BAL_CTL register.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/video')
-rw-r--r-- | drivers/media/video/cx88/cx88-alsa.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c index 5a67445dd6ed..64b350df78e3 100644 --- a/drivers/media/video/cx88/cx88-alsa.c +++ b/drivers/media/video/cx88/cx88-alsa.c | |||
@@ -583,16 +583,18 @@ static int snd_cx88_volume_put(struct snd_kcontrol *kcontrol, | |||
583 | { | 583 | { |
584 | snd_cx88_card_t *chip = snd_kcontrol_chip(kcontrol); | 584 | snd_cx88_card_t *chip = snd_kcontrol_chip(kcontrol); |
585 | struct cx88_core *core=chip->core; | 585 | struct cx88_core *core=chip->core; |
586 | int v, b; | 586 | int left, right, v, b; |
587 | int changed = 0; | 587 | int changed = 0; |
588 | u32 old; | 588 | u32 old; |
589 | 589 | ||
590 | b = value->value.integer.value[1] - value->value.integer.value[0]; | 590 | left = value->value.integer.value[0] & 0x3f; |
591 | right = value->value.integer.value[1] & 0x3f; | ||
592 | b = right - left; | ||
591 | if (b < 0) { | 593 | if (b < 0) { |
592 | v = 0x3f - value->value.integer.value[0]; | 594 | v = 0x3f - left; |
593 | b = (-b) | 0x40; | 595 | b = (-b) | 0x40; |
594 | } else { | 596 | } else { |
595 | v = 0x3f - value->value.integer.value[1]; | 597 | v = 0x3f - right; |
596 | } | 598 | } |
597 | /* Do we really know this will always be called with IRQs on? */ | 599 | /* Do we really know this will always be called with IRQs on? */ |
598 | spin_lock_irq(&chip->reg_lock); | 600 | spin_lock_irq(&chip->reg_lock); |