aboutsummaryrefslogtreecommitdiffstats
path: root/sound/core
diff options
context:
space:
mode:
authorVinod Koul <vinod.koul@linux.intel.com>2012-09-17 02:21:25 -0400
committerTakashi Iwai <tiwai@suse.de>2012-09-17 03:54:41 -0400
commit4dc040a0b34890d2adc0d63da6e9bfb4eb791b19 (patch)
tree751bd8191cca6d4a5119d04bc06362aa93a7c50d /sound/core
parente5d6db8e6039d7f51a9a648d74db1109c7fdc746 (diff)
ALSA: compress - move the buffer check
Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer() added a new error check for input params. this add new routine for input checks and moves buffer overflow check to this new routine. This allows the error value to be propogated to user space Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core')
-rw-r--r--sound/core/compress_offload.c20
1 files changed, 16 insertions, 4 deletions
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 68fe02c7400a..bd7f28e89254 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -407,10 +407,6 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
407 unsigned int buffer_size; 407 unsigned int buffer_size;
408 void *buffer; 408 void *buffer;
409 409
410 if (params->buffer.fragment_size == 0 ||
411 params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
412 return -EINVAL;
413
414 buffer_size = params->buffer.fragment_size * params->buffer.fragments; 410 buffer_size = params->buffer.fragment_size * params->buffer.fragments;
415 if (stream->ops->copy) { 411 if (stream->ops->copy) {
416 buffer = NULL; 412 buffer = NULL;
@@ -429,6 +425,16 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
429 return 0; 425 return 0;
430} 426}
431 427
428static int snd_compress_check_input(struct snd_compr_params *params)
429{
430 /* first let's check the buffer parameter's */
431 if (params->buffer.fragment_size == 0 ||
432 params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
433 return -EINVAL;
434
435 return 0;
436}
437
432static int 438static int
433snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) 439snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
434{ 440{
@@ -447,11 +453,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
447 retval = -EFAULT; 453 retval = -EFAULT;
448 goto out; 454 goto out;
449 } 455 }
456
457 retval = snd_compress_check_input(params);
458 if (retval)
459 goto out;
460
450 retval = snd_compr_allocate_buffer(stream, params); 461 retval = snd_compr_allocate_buffer(stream, params);
451 if (retval) { 462 if (retval) {
452 retval = -ENOMEM; 463 retval = -ENOMEM;
453 goto out; 464 goto out;
454 } 465 }
466
455 retval = stream->ops->set_params(stream, params); 467 retval = stream->ops->set_params(stream, params);
456 if (retval) 468 if (retval)
457 goto out; 469 goto out;