Merge "ALSA: pcm: check for integer overflow during multiplication" (4130a6b8) · Commits · e / devices / android_kernel_oneplus_sm7250

sound/core/pcm_lib.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -1720,6 +1720,11 @@ static int snd_pcm_lib_ioctl_channel_info(struct snd_pcm_substream *substream,
		switch (runtime->access) {
		case SNDRV_PCM_ACCESS_MMAP_INTERLEAVED:
		case SNDRV_PCM_ACCESS_RW_INTERLEAVED:
		if ((UINT_MAX/width) < info->channel) {
		snd_printd("%s: integer overflow while multiply\n",
		__func__);
		return -EINVAL;
		}
		info->first = info->channel * width;
		info->step = runtime->channels * width;
		break;
		@@ -1727,6 +1732,12 @@ static int snd_pcm_lib_ioctl_channel_info(struct snd_pcm_substream *substream,
		case SNDRV_PCM_ACCESS_RW_NONINTERLEAVED:
		{
		size_t size = runtime->dma_bytes / runtime->channels;

		if ((size > 0) && ((UINT_MAX/(size * 8)) < info->channel)) {
		snd_printd("%s: integer overflow while multiply\n",
		__func__);
		return -EINVAL;
		}
		info->first = info->channel * size * 8;
		info->step = width;
		break;