Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0c21fccd authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: asihpi: a couple array out of bounds issues 



These ->put() functions are called from snd_ctl_elem_write() with user
supplied data.  snd_asihpi_tuner_band_put() is missing a limit check and
the check in snd_asihpi_clksrc_put() can underflow.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 3d0049e8

sound/pci/asihpi/asihpi.c

+7 −2
Original line number Diff line number Diff line
@@ -1913,6 +1913,7 @@ static int snd_asihpi_tuner_band_put(struct snd_kcontrol *kcontrol, 
	struct snd_card_asihpi *asihpi = snd_kcontrol_chip(kcontrol);

	*/

	u32 h_control = kcontrol->private_value;

	unsigned int idx;

	u16 band;

	u16 tuner_bands[HPI_TUNER_BAND_LAST];

	u32 num_bands = 0;
@@ -1920,7 +1921,10 @@ static int snd_asihpi_tuner_band_put(struct snd_kcontrol *kcontrol, 
	num_bands = asihpi_tuner_band_query(kcontrol, tuner_bands,

			HPI_TUNER_BAND_LAST);



	band = tuner_bands[ucontrol->value.enumerated.item[0]];

	idx = ucontrol->value.enumerated.item[0];

	if (idx >= ARRAY_SIZE(tuner_bands))

		idx = ARRAY_SIZE(tuner_bands) - 1;

	band = tuner_bands[idx];

	hpi_handle_error(hpi_tuner_set_band(h_control, band));



	return 1;
@@ -2383,7 +2387,8 @@ static int snd_asihpi_clksrc_put(struct snd_kcontrol *kcontrol, 
	struct snd_card_asihpi *asihpi =

			(struct snd_card_asihpi *)(kcontrol->private_data);

	struct clk_cache *clkcache = &asihpi->cc;

	int change, item;

	unsigned int item;

	int change;

	u32 h_control = kcontrol->private_value;



	change = 1;