aboutsummaryrefslogtreecommitdiffstats
path: root/sound
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-04-06 12:31:26 -0400
committerTakashi Iwai <tiwai@suse.de>2010-04-06 12:52:39 -0400
commitb0cc58a25d04160d39a80e436847eaa2fbc5aa09 (patch)
treea20f259f6d2081e40ac979db8daad6b71ff7342c /sound
parenta0fd4345f928d72a56e27b23e4cd28c94bf36be5 (diff)
ALSA: mixart: range checking proc file
The original code doesn't take into consideration that the value of MIXART_BA0_SIZE - pos can be less than zero which would lead to a large unsigned value for "count". Also I moved the check that read size is a multiple of 4 bytes below the code that adjusts "count". Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: <stable@kernel.org> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r--sound/pci/mixart/mixart.c24
1 files changed, 14 insertions, 10 deletions
diff --git a/sound/pci/mixart/mixart.c b/sound/pci/mixart/mixart.c
index 7e8e7da592a9..ea4256b08a38 100644
--- a/sound/pci/mixart/mixart.c
+++ b/sound/pci/mixart/mixart.c
@@ -1161,13 +1161,15 @@ static long snd_mixart_BA0_read(struct snd_info_entry *entry, void *file_private
1161 unsigned long count, unsigned long pos) 1161 unsigned long count, unsigned long pos)
1162{ 1162{
1163 struct mixart_mgr *mgr = entry->private_data; 1163 struct mixart_mgr *mgr = entry->private_data;
1164 unsigned long maxsize;
1164 1165
1165 count = count & ~3; /* make sure the read size is a multiple of 4 bytes */ 1166 if (pos >= MIXART_BA0_SIZE)
1166 if(count <= 0)
1167 return 0; 1167 return 0;
1168 if(pos + count > MIXART_BA0_SIZE) 1168 maxsize = MIXART_BA0_SIZE - pos;
1169 count = (long)(MIXART_BA0_SIZE - pos); 1169 if (count > maxsize)
1170 if(copy_to_user_fromio(buf, MIXART_MEM( mgr, pos ), count)) 1170 count = maxsize;
1171 count = count & ~3; /* make sure the read size is a multiple of 4 bytes */
1172 if (copy_to_user_fromio(buf, MIXART_MEM(mgr, pos), count))
1171 return -EFAULT; 1173 return -EFAULT;
1172 return count; 1174 return count;
1173} 1175}
@@ -1180,13 +1182,15 @@ static long snd_mixart_BA1_read(struct snd_info_entry *entry, void *file_private
1180 unsigned long count, unsigned long pos) 1182 unsigned long count, unsigned long pos)
1181{ 1183{
1182 struct mixart_mgr *mgr = entry->private_data; 1184 struct mixart_mgr *mgr = entry->private_data;
1185 unsigned long maxsize;
1183 1186
1184 count = count & ~3; /* make sure the read size is a multiple of 4 bytes */ 1187 if (pos > MIXART_BA1_SIZE)
1185 if(count <= 0)
1186 return 0; 1188 return 0;
1187 if(pos + count > MIXART_BA1_SIZE) 1189 maxsize = MIXART_BA1_SIZE - pos;
1188 count = (long)(MIXART_BA1_SIZE - pos); 1190 if (count > maxsize)
1189 if(copy_to_user_fromio(buf, MIXART_REG( mgr, pos ), count)) 1191 count = maxsize;
1192 count = count & ~3; /* make sure the read size is a multiple of 4 bytes */
1193 if (copy_to_user_fromio(buf, MIXART_REG(mgr, pos), count))
1190 return -EFAULT; 1194 return -EFAULT;
1191 return count; 1195 return count;
1192} 1196}