iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[ALSA] emu10k1 - Check value ranges in ctl callbacks

Browse Source 
Check value ranges in ctl callbacks properly.  This fixes the unexpected
crash due to wrong value assignment.
Also, remove invalid comments in the last patch.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
This commit is contained in:
Takashi Iwai 2007-11-15 13:16:02 +01:00 committed by Mercurial server
parent 74415a3676
commit aa299d01f1
2 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
sound/pci/emu10k1/emumixer.c
View File

@ -293,12 +293,15 @@ static int snd_emu1010_output_source_put(struct snd_kcontrol *kcontrol,
unsigned int val; unsigned int val;
unsigned int channel; unsigned int channel;
val = ucontrol->value.enumerated.item[0];
if (val >= 53)
return -EINVAL;
channel = (kcontrol->private_value) & 0xff; channel = (kcontrol->private_value) & 0xff;
/* Limit: emu1010_output_dst, emu->emu1010.output_source */ /* Limit: emu1010_output_dst, emu->emu1010.output_source */
if (channel >= 24) if (channel >= 24)
return -EINVAL; return -EINVAL;
if (emu->emu1010.output_source[channel] != ucontrol->value.enumerated.item[0]) { if (emu->emu1010.output_source[channel] != val) {
val = emu->emu1010.output_source[channel] = ucontrol->value.enumerated.item[0]; emu->emu1010.output_source[channel] = val;
change = 1; change = 1;
snd_emu1010_fpga_link_dst_src_write(emu, snd_emu1010_fpga_link_dst_src_write(emu,
emu1010_output_dst[channel], emu1010_src_regs[val]); emu1010_output_dst[channel], emu1010_src_regs[val]);
@ -328,12 +331,15 @@ static int snd_emu1010_input_source_put(struct snd_kcontrol *kcontrol,
unsigned int val; unsigned int val;
unsigned int channel; unsigned int channel;
val = ucontrol->value.enumerated.item[0];
if (val >= 53)
return -EINVAL;
channel = (kcontrol->private_value) & 0xff; channel = (kcontrol->private_value) & 0xff;
/* Limit: emu1010_input_dst, emu->emu1010.input_source */ /* Limit: emu1010_input_dst, emu->emu1010.input_source */
if (channel >= 22) if (channel >= 22)
return -EINVAL; return -EINVAL;
if (emu->emu1010.input_source[channel] != ucontrol->value.enumerated.item[0]) { if (emu->emu1010.input_source[channel] != val) {
val = emu->emu1010.input_source[channel] = ucontrol->value.enumerated.item[0]; emu->emu1010.input_source[channel] = val;
change = 1; change = 1;
snd_emu1010_fpga_link_dst_src_write(emu, snd_emu1010_fpga_link_dst_src_write(emu,
emu1010_input_dst[channel], emu1010_src_regs[val]); emu1010_input_dst[channel], emu1010_src_regs[val]);
@ -1083,7 +1089,6 @@ static int snd_emu10k1_send_volume_put(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
struct snd_emu10k1_pcm_mixer *mix = struct snd_emu10k1_pcm_mixer *mix =
&emu->pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)]; &emu->pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)];
int change = 0, idx, val; int change = 0, idx, val;
@ -1136,7 +1141,6 @@ static int snd_emu10k1_attn_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol) struct snd_ctl_elem_value *ucontrol)
{ {
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
struct snd_emu10k1_pcm_mixer *mix = struct snd_emu10k1_pcm_mixer *mix =
&emu->pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)]; &emu->pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)];
unsigned long flags; unsigned long flags;
@ -1154,7 +1158,6 @@ static int snd_emu10k1_attn_put(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
struct snd_emu10k1_pcm_mixer *mix = struct snd_emu10k1_pcm_mixer *mix =
&emu->pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)]; &emu->pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)];
int change = 0, idx, val; int change = 0, idx, val;
@ -1207,7 +1210,6 @@ static int snd_emu10k1_efx_send_routing_get(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
struct snd_emu10k1_pcm_mixer *mix = struct snd_emu10k1_pcm_mixer *mix =
&emu->efx_pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)]; &emu->efx_pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)];
int idx; int idx;
@ -1227,7 +1229,6 @@ static int snd_emu10k1_efx_send_routing_put(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
int ch = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id); int ch = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
struct snd_emu10k1_pcm_mixer *mix = &emu->efx_pcm_mixer[ch]; struct snd_emu10k1_pcm_mixer *mix = &emu->efx_pcm_mixer[ch];
int change = 0, idx, val; int change = 0, idx, val;
@ -1279,7 +1280,6 @@ static int snd_emu10k1_efx_send_volume_get(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
struct snd_emu10k1_pcm_mixer *mix = struct snd_emu10k1_pcm_mixer *mix =
&emu->efx_pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)]; &emu->efx_pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)];
int idx; int idx;
@ -1297,7 +1297,6 @@ static int snd_emu10k1_efx_send_volume_put(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
int ch = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id); int ch = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
struct snd_emu10k1_pcm_mixer *mix = &emu->efx_pcm_mixer[ch]; struct snd_emu10k1_pcm_mixer *mix = &emu->efx_pcm_mixer[ch];
int change = 0, idx, val; int change = 0, idx, val;
@ -1346,7 +1345,6 @@ static int snd_emu10k1_efx_attn_get(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol) struct snd_ctl_elem_value *ucontrol)
{ {
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
struct snd_emu10k1_pcm_mixer *mix = struct snd_emu10k1_pcm_mixer *mix =
&emu->efx_pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)]; &emu->efx_pcm_mixer[snd_ctl_get_ioffidx(kcontrol, &ucontrol->id)];
unsigned long flags; unsigned long flags;
@ -1362,7 +1360,6 @@ static int snd_emu10k1_efx_attn_put(struct snd_kcontrol *kcontrol,
{ {
unsigned long flags; unsigned long flags;
struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol); struct snd_emu10k1 *emu = snd_kcontrol_chip(kcontrol);
/* FIXME: Check limits */
int ch = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id); int ch = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
struct snd_emu10k1_pcm_mixer *mix = &emu->efx_pcm_mixer[ch]; struct snd_emu10k1_pcm_mixer *mix = &emu->efx_pcm_mixer[ch];
int change = 0, val; int change = 0, val;

4
sound/pci/emu10k1/p16v.c
View File

@ -742,6 +742,8 @@ static int snd_p16v_capture_source_put(struct snd_kcontrol *kcontrol,
u32 source; u32 source;
val = ucontrol->value.enumerated.item[0] ; val = ucontrol->value.enumerated.item[0] ;
if (val > 7)
return -EINVAL;
change = (emu->p16v_capture_source != val); change = (emu->p16v_capture_source != val);
if (change) { if (change) {
emu->p16v_capture_source = val; emu->p16v_capture_source = val;
@ -784,6 +786,8 @@ static int snd_p16v_capture_channel_put(struct snd_kcontrol *kcontrol,
u32 tmp; u32 tmp;
val = ucontrol->value.enumerated.item[0] ; val = ucontrol->value.enumerated.item[0] ;
if (val > 3)
return -EINVAL;
change = (emu->p16v_capture_channel != val); change = (emu->p16v_capture_channel != val);
if (change) { if (change) {
emu->p16v_capture_channel = val; emu->p16v_capture_channel = val;