diff options
Diffstat (limited to 'sound/pci/emu10k1/emu10k1_patch.c')
-rw-r--r-- | sound/pci/emu10k1/emu10k1_patch.c | 23 |
1 files changed, 14 insertions, 9 deletions
diff --git a/sound/pci/emu10k1/emu10k1_patch.c b/sound/pci/emu10k1/emu10k1_patch.c index 42bae6f7e9a4..e10f027bde03 100644 --- a/sound/pci/emu10k1/emu10k1_patch.c +++ b/sound/pci/emu10k1/emu10k1_patch.c | |||
@@ -46,8 +46,8 @@ snd_emu10k1_sample_new(struct snd_emux *rec, struct snd_sf_sample *sp, | |||
46 | struct snd_emu10k1 *emu; | 46 | struct snd_emu10k1 *emu; |
47 | 47 | ||
48 | emu = rec->hw; | 48 | emu = rec->hw; |
49 | snd_assert(sp != NULL, return -EINVAL); | 49 | if (snd_BUG_ON(!sp || !hdr)) |
50 | snd_assert(hdr != NULL, return -EINVAL); | 50 | return -EINVAL; |
51 | 51 | ||
52 | if (sp->v.size == 0) { | 52 | if (sp->v.size == 0) { |
53 | snd_printd("emu: rom font for sample %d\n", sp->v.sample); | 53 | snd_printd("emu: rom font for sample %d\n", sp->v.sample); |
@@ -104,7 +104,8 @@ snd_emu10k1_sample_new(struct snd_emux *rec, struct snd_sf_sample *sp, | |||
104 | size = BLANK_HEAD_SIZE; | 104 | size = BLANK_HEAD_SIZE; |
105 | if (! (sp->v.mode_flags & SNDRV_SFNT_SAMPLE_8BITS)) | 105 | if (! (sp->v.mode_flags & SNDRV_SFNT_SAMPLE_8BITS)) |
106 | size *= 2; | 106 | size *= 2; |
107 | snd_assert(offset + size <= blocksize, return -EINVAL); | 107 | if (offset + size > blocksize) |
108 | return -EINVAL; | ||
108 | snd_emu10k1_synth_bzero(emu, sp->block, offset, size); | 109 | snd_emu10k1_synth_bzero(emu, sp->block, offset, size); |
109 | offset += size; | 110 | offset += size; |
110 | 111 | ||
@@ -112,7 +113,8 @@ snd_emu10k1_sample_new(struct snd_emux *rec, struct snd_sf_sample *sp, | |||
112 | size = loopend; | 113 | size = loopend; |
113 | if (! (sp->v.mode_flags & SNDRV_SFNT_SAMPLE_8BITS)) | 114 | if (! (sp->v.mode_flags & SNDRV_SFNT_SAMPLE_8BITS)) |
114 | size *= 2; | 115 | size *= 2; |
115 | snd_assert(offset + size <= blocksize, return -EINVAL); | 116 | if (offset + size > blocksize) |
117 | return -EINVAL; | ||
116 | if (snd_emu10k1_synth_copy_from_user(emu, sp->block, offset, data, size)) { | 118 | if (snd_emu10k1_synth_copy_from_user(emu, sp->block, offset, data, size)) { |
117 | snd_emu10k1_synth_free(emu, sp->block); | 119 | snd_emu10k1_synth_free(emu, sp->block); |
118 | sp->block = NULL; | 120 | sp->block = NULL; |
@@ -129,12 +131,14 @@ snd_emu10k1_sample_new(struct snd_emux *rec, struct snd_sf_sample *sp, | |||
129 | int woffset; | 131 | int woffset; |
130 | unsigned short *wblock = (unsigned short*)block; | 132 | unsigned short *wblock = (unsigned short*)block; |
131 | woffset = offset / 2; | 133 | woffset = offset / 2; |
132 | snd_assert(offset + loopsize*2 <= blocksize, return -EINVAL); | 134 | if (offset + loopsize * 2 > blocksize) |
135 | return -EINVAL; | ||
133 | for (i = 0; i < loopsize; i++) | 136 | for (i = 0; i < loopsize; i++) |
134 | wblock[woffset + i] = wblock[woffset - i -1]; | 137 | wblock[woffset + i] = wblock[woffset - i -1]; |
135 | offset += loopsize * 2; | 138 | offset += loopsize * 2; |
136 | } else { | 139 | } else { |
137 | snd_assert(offset + loopsize <= blocksize, return -EINVAL); | 140 | if (offset + loopsize > blocksize) |
141 | return -EINVAL; | ||
138 | for (i = 0; i < loopsize; i++) | 142 | for (i = 0; i < loopsize; i++) |
139 | block[offset + i] = block[offset - i -1]; | 143 | block[offset + i] = block[offset - i -1]; |
140 | offset += loopsize; | 144 | offset += loopsize; |
@@ -154,7 +158,8 @@ snd_emu10k1_sample_new(struct snd_emux *rec, struct snd_sf_sample *sp, | |||
154 | 158 | ||
155 | /* loopend -> sample end */ | 159 | /* loopend -> sample end */ |
156 | size = sp->v.size - loopend; | 160 | size = sp->v.size - loopend; |
157 | snd_assert(size >= 0, return -EINVAL); | 161 | if (size < 0) |
162 | return -EINVAL; | ||
158 | if (! (sp->v.mode_flags & SNDRV_SFNT_SAMPLE_8BITS)) | 163 | if (! (sp->v.mode_flags & SNDRV_SFNT_SAMPLE_8BITS)) |
159 | size *= 2; | 164 | size *= 2; |
160 | if (snd_emu10k1_synth_copy_from_user(emu, sp->block, offset, data, size)) { | 165 | if (snd_emu10k1_synth_copy_from_user(emu, sp->block, offset, data, size)) { |
@@ -212,8 +217,8 @@ snd_emu10k1_sample_free(struct snd_emux *rec, struct snd_sf_sample *sp, | |||
212 | struct snd_emu10k1 *emu; | 217 | struct snd_emu10k1 *emu; |
213 | 218 | ||
214 | emu = rec->hw; | 219 | emu = rec->hw; |
215 | snd_assert(sp != NULL, return -EINVAL); | 220 | if (snd_BUG_ON(!sp || !hdr)) |
216 | snd_assert(hdr != NULL, return -EINVAL); | 221 | return -EINVAL; |
217 | 222 | ||
218 | if (sp->block) { | 223 | if (sp->block) { |
219 | snd_emu10k1_synth_free(emu, sp->block); | 224 | snd_emu10k1_synth_free(emu, sp->block); |