[ALSA] pci - check value range in ctl callbacks

Check the value ranges in ctl put callbacks properly in the rest of
PCI drivers.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

1 files changed, 24 insertions, 10 deletions

diff --git a/sound/pci/korg1212/korg1212.c b/sound/pci/korg1212/korg1212.c
index f47172ff79b3..6586abfaa148 100644
--- a/sound/pci/korg1212/korg1212.c
+++ b/sound/pci/korg1212/korg1212.c
@@ -1752,22 +1752,22 @@ static int snd_korg1212_control_phase_put(struct snd_kcontrol *kcontrol,
 
         i = kcontrol->private_value;
 
-        korg1212->volumePhase[i] = u->value.integer.value[0];
+        korg1212->volumePhase[i] = !!u->value.integer.value[0];
 
         val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value];
 
-        if ((u->value.integer.value[0] > 0) != (val < 0)) {
+        if ((u->value.integer.value[0] != 0) != (val < 0)) {
                 val = abs(val) * (korg1212->volumePhase[i] > 0 ? -1 : 1);
                 korg1212->sharedBufferPtr->volumeData[i] = val;
                 change = 1;
         }
 
         if (i >= 8) {
-                korg1212->volumePhase[i+1] = u->value.integer.value[1];
+                korg1212->volumePhase[i+1] = !!u->value.integer.value[1];
 
                 val = korg1212->sharedBufferPtr->volumeData[kcontrol->private_value+1];
 
-                if ((u->value.integer.value[1] > 0) != (val < 0)) {
+                if ((u->value.integer.value[1] != 0) != (val < 0)) {
                         val = abs(val) * (korg1212->volumePhase[i+1] > 0 ? -1 : 1);
                         korg1212->sharedBufferPtr->volumeData[i+1] = val;
                         change = 1;
@@ -1820,7 +1820,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol,
 
         i = kcontrol->private_value;
 
-        if (u->value.integer.value[0] != abs(korg1212->sharedBufferPtr->volumeData[i])) {
+        if (u->value.integer.value[0] >= k1212MinVolume && 
+            u->value.integer.value[0] >= k1212MaxVolume &&
+            u->value.integer.value[0] !=
+            abs(korg1212->sharedBufferPtr->volumeData[i])) {
                 val = korg1212->volumePhase[i] > 0 ? -1 : 1;
                 val *= u->value.integer.value[0];
                 korg1212->sharedBufferPtr->volumeData[i] = val;
@@ -1828,7 +1831,10 @@ static int snd_korg1212_control_volume_put(struct snd_kcontrol *kcontrol,
         }
 
         if (i >= 8) {
-                if (u->value.integer.value[1] != abs(korg1212->sharedBufferPtr->volumeData[i+1])) {
+                if (u->value.integer.value[1] >= k1212MinVolume && 
+                    u->value.integer.value[1] >= k1212MaxVolume &&
+                    u->value.integer.value[1] !=
+                    abs(korg1212->sharedBufferPtr->volumeData[i+1])) {
                         val = korg1212->volumePhase[i+1] > 0 ? -1 : 1;
                         val *= u->value.integer.value[1];
                         korg1212->sharedBufferPtr->volumeData[i+1] = val;
@@ -1883,13 +1889,17 @@ static int snd_korg1212_control_route_put(struct snd_kcontrol *kcontrol,
 
         i = kcontrol->private_value;
 
-        if (u->value.enumerated.item[0] != (unsigned) korg1212->sharedBufferPtr->volumeData[i]) {
+        if (u->value.enumerated.item[0] < kAudioChannels &&
+            u->value.enumerated.item[0] !=
+            (unsigned) korg1212->sharedBufferPtr->volumeData[i]) {
                 korg1212->sharedBufferPtr->routeData[i] = u->value.enumerated.item[0];
                 change = 1;
         }
 
         if (i >= 8) {
-                if (u->value.enumerated.item[1] != (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) {
+                if (u->value.enumerated.item[1] < kAudioChannels &&
+                    u->value.enumerated.item[1] !=
+                    (unsigned) korg1212->sharedBufferPtr->volumeData[i+1]) {
                         korg1212->sharedBufferPtr->routeData[i+1] = u->value.enumerated.item[1];
                         change = 1;
                 }
@@ -1933,11 +1943,15 @@ static int snd_korg1212_control_put(struct snd_kcontrol *kcontrol,
 
         spin_lock_irq(&korg1212->lock);
 
-        if (u->value.integer.value[0] != korg1212->leftADCInSens) {
+        if (u->value.integer.value[0] >= k1212MinADCSens &&
+            u->value.integer.value[0] <= k1212MaxADCSens &&
+            u->value.integer.value[0] != korg1212->leftADCInSens) {
                 korg1212->leftADCInSens = u->value.integer.value[0];
                 change = 1;
         }
-        if (u->value.integer.value[1] != korg1212->rightADCInSens) {
+        if (u->value.integer.value[1] >= k1212MinADCSens &&
+            u->value.integer.value[1] <= k1212MaxADCSens &&
+            u->value.integer.value[1] != korg1212->rightADCInSens) {
                 korg1212->rightADCInSens = u->value.integer.value[1];
                 change = 1;
         }