Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5885615e authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: emux: stop if copy_from_user() fails 



If we can't fill the "patch" struct because "count" is too small (it can
be as low as 4 bytes) or because copy_from_user() failed, then just
return instead of using unintialized data.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 03a1f48e

sound/synth/emux/emux_oss.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -225,9 +225,9 @@ snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format, 
	else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {

	else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {

		struct soundfont_patch_info patch;

		struct soundfont_patch_info patch;

		if (count < (int)sizeof(patch))

		if (count < (int)sizeof(patch))

			rc = -EINVAL;

			return -EINVAL;

		if (copy_from_user(&patch, buf, sizeof(patch)))

		if (copy_from_user(&patch, buf, sizeof(patch)))

			rc = -EFAULT;

			return -EFAULT;

		if (patch.type >= SNDRV_SFNT_LOAD_INFO &&

		if (patch.type >= SNDRV_SFNT_LOAD_INFO &&

		    patch.type <= SNDRV_SFNT_PROBE_DATA)

		    patch.type <= SNDRV_SFNT_PROBE_DATA)

			rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));

			rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));