aboutsummaryrefslogtreecommitdiffstats
path: root/sound
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-01-03 06:39:27 -0500
committerJaroslav Kysela <perex@perex.cz>2010-01-08 03:17:51 -0500
commit444c1953d496d272208902ff7010dc70d1f887f0 (patch)
tree40aa1e10f108818b3b7d12384229c0501aeb5a12 /sound
parent440b004cf953bec2bc8cd91c64ae707fd7e25327 (diff)
sound: oss: off by one bug
The problem is that in the original code sound_nblocks could go up to 1024 which would be an array overflow. This was found with a static checker and has been compile tested only. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound')
-rw-r--r--sound/oss/dev_table.c16
-rw-r--r--sound/oss/sound_config.h2
-rw-r--r--sound/oss/soundcard.c4
3 files changed, 13 insertions, 9 deletions
diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c
index 08274c995d06..727bdb9ba2dc 100644
--- a/sound/oss/dev_table.c
+++ b/sound/oss/dev_table.c
@@ -67,14 +67,15 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver,
67 return -(EBUSY); 67 return -(EBUSY);
68 } 68 }
69 d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver))); 69 d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver)));
70 70 sound_nblocks++;
71 if (sound_nblocks < 1024) 71 if (sound_nblocks >= MAX_MEM_BLOCKS)
72 sound_nblocks++; 72 sound_nblocks = MAX_MEM_BLOCKS - 1;
73 73
74 op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations))); 74 op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations)));
75 sound_nblocks++;
76 if (sound_nblocks >= MAX_MEM_BLOCKS)
77 sound_nblocks = MAX_MEM_BLOCKS - 1;
75 78
76 if (sound_nblocks < 1024)
77 sound_nblocks++;
78 if (d == NULL || op == NULL) { 79 if (d == NULL || op == NULL) {
79 printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name); 80 printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name);
80 sound_unload_audiodev(num); 81 sound_unload_audiodev(num);
@@ -128,9 +129,10 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver,
128 until you unload sound! */ 129 until you unload sound! */
129 130
130 op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations))); 131 op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations)));
132 sound_nblocks++;
133 if (sound_nblocks >= MAX_MEM_BLOCKS)
134 sound_nblocks = MAX_MEM_BLOCKS - 1;
131 135
132 if (sound_nblocks < 1024)
133 sound_nblocks++;
134 if (op == NULL) { 136 if (op == NULL) {
135 printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name); 137 printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name);
136 return -ENOMEM; 138 return -ENOMEM;
diff --git a/sound/oss/sound_config.h b/sound/oss/sound_config.h
index 55271fbe7f49..9d35c4c65b9b 100644
--- a/sound/oss/sound_config.h
+++ b/sound/oss/sound_config.h
@@ -142,4 +142,6 @@ static inline int translate_mode(struct file *file)
142#define TIMER_ARMED 121234 142#define TIMER_ARMED 121234
143#define TIMER_NOT_ARMED 1 143#define TIMER_NOT_ARMED 1
144 144
145#define MAX_MEM_BLOCKS 1024
146
145#endif 147#endif
diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
index 61aaedae6b7e..c62530943888 100644
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -56,7 +56,7 @@
56/* 56/*
57 * Table for permanently allocated memory (used when unloading the module) 57 * Table for permanently allocated memory (used when unloading the module)
58 */ 58 */
59void * sound_mem_blocks[1024]; 59void * sound_mem_blocks[MAX_MEM_BLOCKS];
60int sound_nblocks = 0; 60int sound_nblocks = 0;
61 61
62/* Persistent DMA buffers */ 62/* Persistent DMA buffers */
@@ -574,7 +574,7 @@ static int __init oss_init(void)
574 NULL, "%s%d", dev_list[i].name, j); 574 NULL, "%s%d", dev_list[i].name, j);
575 } 575 }
576 576
577 if (sound_nblocks >= 1024) 577 if (sound_nblocks >= MAX_MEM_BLOCKS - 1)
578 printk(KERN_ERR "Sound warning: Deallocation table was too small.\n"); 578 printk(KERN_ERR "Sound warning: Deallocation table was too small.\n");
579 579
580 return 0; 580 return 0;