aboutsummaryrefslogtreecommitdiffstats
path: root/sound
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2007-11-15 10:17:24 -0500
committerJaroslav Kysela <perex@perex.cz>2008-01-31 11:29:25 -0500
commit3b892467786410f26dffc2c7bccd3ea445604037 (patch)
tree4a70f86b1545e9be95d987fc248cac3cebbbd9a8 /sound
parent498ade1a133dffd0f3ee90952737045d56e6689a (diff)
[ALSA] Check value range in ctl callbacks
Check the value ranges in ctl put callbacks properly (in the rest drivers). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound')
-rw-r--r--sound/drivers/mts64.c12
-rw-r--r--sound/i2c/other/pt2258.c2
-rw-r--r--sound/isa/opti9xx/miro.c8
-rw-r--r--sound/sh/aica.c7
-rw-r--r--sound/sparc/amd7930.c2
-rw-r--r--sound/sparc/dbri.c13
6 files changed, 36 insertions, 8 deletions
diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
index dcc90f995294..68070cccc6be 100644
--- a/sound/drivers/mts64.c
+++ b/sound/drivers/mts64.c
@@ -461,13 +461,14 @@ static int snd_mts64_ctl_smpte_switch_put(struct snd_kcontrol* kctl,
461{ 461{
462 struct mts64 *mts = snd_kcontrol_chip(kctl); 462 struct mts64 *mts = snd_kcontrol_chip(kctl);
463 int changed = 0; 463 int changed = 0;
464 int val = !!uctl->value.integer.value[0];
464 465
465 spin_lock_irq(&mts->lock); 466 spin_lock_irq(&mts->lock);
466 if (mts->smpte_switch == uctl->value.integer.value[0]) 467 if (mts->smpte_switch == val)
467 goto __out; 468 goto __out;
468 469
469 changed = 1; 470 changed = 1;
470 mts->smpte_switch = uctl->value.integer.value[0]; 471 mts->smpte_switch = val;
471 if (mts->smpte_switch) { 472 if (mts->smpte_switch) {
472 mts64_smpte_start(mts->pardev->port, 473 mts64_smpte_start(mts->pardev->port,
473 mts->time[0], mts->time[1], 474 mts->time[0], mts->time[1],
@@ -541,12 +542,13 @@ static int snd_mts64_ctl_smpte_time_put(struct snd_kcontrol *kctl,
541{ 542{
542 struct mts64 *mts = snd_kcontrol_chip(kctl); 543 struct mts64 *mts = snd_kcontrol_chip(kctl);
543 int idx = kctl->private_value; 544 int idx = kctl->private_value;
545 unsigned int time = uctl->value.integer.value[0] % 60;
544 int changed = 0; 546 int changed = 0;
545 547
546 spin_lock_irq(&mts->lock); 548 spin_lock_irq(&mts->lock);
547 if (mts->time[idx] != uctl->value.integer.value[0]) { 549 if (mts->time[idx] != time) {
548 changed = 1; 550 changed = 1;
549 mts->time[idx] = uctl->value.integer.value[0]; 551 mts->time[idx] = time;
550 } 552 }
551 spin_unlock_irq(&mts->lock); 553 spin_unlock_irq(&mts->lock);
552 554
@@ -636,6 +638,8 @@ static int snd_mts64_ctl_smpte_fps_put(struct snd_kcontrol *kctl,
636 struct mts64 *mts = snd_kcontrol_chip(kctl); 638 struct mts64 *mts = snd_kcontrol_chip(kctl);
637 int changed = 0; 639 int changed = 0;
638 640
641 if (uctl->value.enumerated.item[0] >= 5)
642 return -EINVAL;
639 spin_lock_irq(&mts->lock); 643 spin_lock_irq(&mts->lock);
640 if (mts->fps != uctl->value.enumerated.item[0]) { 644 if (mts->fps != uctl->value.enumerated.item[0]) {
641 changed = 1; 645 changed = 1;
diff --git a/sound/i2c/other/pt2258.c b/sound/i2c/other/pt2258.c
index 00c83d8b32b1..987d2c9a7a64 100644
--- a/sound/i2c/other/pt2258.c
+++ b/sound/i2c/other/pt2258.c
@@ -113,6 +113,8 @@ static int pt2258_stereo_volume_put(struct snd_kcontrol *kcontrol,
113 113
114 val0 = 79 - ucontrol->value.integer.value[0]; 114 val0 = 79 - ucontrol->value.integer.value[0];
115 val1 = 79 - ucontrol->value.integer.value[1]; 115 val1 = 79 - ucontrol->value.integer.value[1];
116 if (val0 < 0 || val0 > 79 || val1 < 0 || val1 > 79)
117 return -EINVAL;
116 if (val0 == pt->volume[base] && val1 == pt->volume[base + 1]) 118 if (val0 == pt->volume[base] && val1 == pt->volume[base + 1])
117 return 0; 119 return 0;
118 120
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
index d295936611f8..c2baf4cfb958 100644
--- a/sound/isa/opti9xx/miro.c
+++ b/sound/isa/opti9xx/miro.c
@@ -483,6 +483,10 @@ static int snd_miro_put_double(struct snd_kcontrol *kcontrol,
483 483
484 /* equalizer elements */ 484 /* equalizer elements */
485 485
486 if (left < -0x7f || left > 0x7f ||
487 right < -0x7f || right > 0x7f)
488 return -EINVAL;
489
486 if (left_old > 0x80) 490 if (left_old > 0x80)
487 left_old = 0x80 - left_old; 491 left_old = 0x80 - left_old;
488 if (right_old > 0x80) 492 if (right_old > 0x80)
@@ -520,6 +524,10 @@ static int snd_miro_put_double(struct snd_kcontrol *kcontrol,
520 524
521 /* non-equalizer elements */ 525 /* non-equalizer elements */
522 526
527 if (left < 0 || left > 0x20 ||
528 right < 0 || right > 0x20)
529 return -EINVAL;
530
523 left_old = 0x20 - left_old; 531 left_old = 0x20 - left_old;
524 right_old = 0x20 - right_old; 532 right_old = 0x20 - right_old;
525 533
diff --git a/sound/sh/aica.c b/sound/sh/aica.c
index 8861d2f7796e..12c41df255a1 100644
--- a/sound/sh/aica.c
+++ b/sound/sh/aica.c
@@ -523,11 +523,14 @@ static int aica_pcmvolume_put(struct snd_kcontrol *kcontrol,
523 struct snd_ctl_elem_value *ucontrol) 523 struct snd_ctl_elem_value *ucontrol)
524{ 524{
525 struct snd_card_aica *dreamcastcard; 525 struct snd_card_aica *dreamcastcard;
526 unsigned int vol;
526 dreamcastcard = kcontrol->private_data; 527 dreamcastcard = kcontrol->private_data;
527 if (unlikely(!dreamcastcard->channel)) 528 if (unlikely(!dreamcastcard->channel))
528 return -ETXTBSY; 529 return -ETXTBSY;
529 if (unlikely(dreamcastcard->channel->vol == 530 vol = ucontrol->value.integer.value[0];
530 ucontrol->value.integer.value[0])) 531 if (vol > 0xff)
532 return -EINVAL;
533 if (unlikely(dreamcastcard->channel->vol == vol))
531 return 0; 534 return 0;
532 dreamcastcard->channel->vol = ucontrol->value.integer.value[0]; 535 dreamcastcard->channel->vol = ucontrol->value.integer.value[0];
533 dreamcastcard->master_volume = ucontrol->value.integer.value[0]; 536 dreamcastcard->master_volume = ucontrol->value.integer.value[0];
diff --git a/sound/sparc/amd7930.c b/sound/sparc/amd7930.c
index 07962a35f241..b1d431587158 100644
--- a/sound/sparc/amd7930.c
+++ b/sound/sparc/amd7930.c
@@ -859,7 +859,7 @@ static int snd_amd7930_put_volume(struct snd_kcontrol *kctl, struct snd_ctl_elem
859 spin_lock_irqsave(&amd->lock, flags); 859 spin_lock_irqsave(&amd->lock, flags);
860 860
861 if (*swval != ucontrol->value.integer.value[0]) { 861 if (*swval != ucontrol->value.integer.value[0]) {
862 *swval = ucontrol->value.integer.value[0]; 862 *swval = ucontrol->value.integer.value[0] & 0xff;
863 __amd7930_update_map(amd); 863 __amd7930_update_map(amd);
864 change = 1; 864 change = 1;
865 } else 865 } else
diff --git a/sound/sparc/dbri.c b/sound/sparc/dbri.c
index 376b98691c96..af1bf4bf9459 100644
--- a/sound/sparc/dbri.c
+++ b/sound/sparc/dbri.c
@@ -2279,9 +2279,20 @@ static int snd_cs4215_put_volume(struct snd_kcontrol *kcontrol,
2279 struct snd_dbri *dbri = snd_kcontrol_chip(kcontrol); 2279 struct snd_dbri *dbri = snd_kcontrol_chip(kcontrol);
2280 struct dbri_streaminfo *info = 2280 struct dbri_streaminfo *info =
2281 &dbri->stream_info[kcontrol->private_value]; 2281 &dbri->stream_info[kcontrol->private_value];
2282 unsigned int vol[2];
2282 int changed = 0; 2283 int changed = 0;
2283 2284
2284 if (info->left_gain != ucontrol->value.integer.value[0]) { 2285 vol[0] = ucontrol->value.integer.value[0];
2286 vol[1] = ucontrol->value.integer.value[1];
2287 if (kcontrol->private_value == DBRI_PLAY) {
2288 if (vol[0] > DBRI_MAX_VOLUME || vol[1] > DBRI_MAX_VOLUME)
2289 return -EINVAL;
2290 } else {
2291 if (vol[0] > DBRI_MAX_GAIN || vol[1] > DBRI_MAX_GAIN)
2292 return -EINVAL;
2293 }
2294
2295 if (info->left_gain !=
2285 info->left_gain = ucontrol->value.integer.value[0]; 2296 info->left_gain = ucontrol->value.integer.value[0];
2286 changed = 1; 2297 changed = 1;
2287 } 2298 }