Merge "ALSA: pcm: check for integer overflow during multiplication" into msm-4.8 (3225b61e) · Commits · e / devices / android_kernel_fairphone_FP3

sound/core/pcm_lib.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -1792,6 +1792,11 @@ static int snd_pcm_lib_ioctl_channel_info(struct snd_pcm_substream *substream,
		switch (runtime->access) {
		case SNDRV_PCM_ACCESS_MMAP_INTERLEAVED:
		case SNDRV_PCM_ACCESS_RW_INTERLEAVED:
		if ((UINT_MAX/width) < info->channel) {
		snd_printd("%s: integer overflow while multiply\n",
		__func__);
		return -EINVAL;
		}
		info->first = info->channel * width;
		info->step = runtime->channels * width;
		break;
		@@ -1799,6 +1804,12 @@ static int snd_pcm_lib_ioctl_channel_info(struct snd_pcm_substream *substream,
		case SNDRV_PCM_ACCESS_RW_NONINTERLEAVED:
		{
		size_t size = runtime->dma_bytes / runtime->channels;

		if ((size > 0) && ((UINT_MAX/(size * 8)) < info->channel)) {
		snd_printd("%s: integer overflow while multiply\n",
		__func__);
		return -EINVAL;
		}
		info->first = info->channel * size * 8;
		info->step = width;
		break;