Commit 0b444af8 authored Feb 11, 2015 by Dan Carpenter Committed by Takashi Iwai Feb 12, 2015

ALSA: seq: potential out of bounds in do_control()



Smatch complains that "control" is user specifigy and needs to be
capped.  The call tree to understand this warning is quite long.

snd_seq_write()  <-- get the event from the user
  snd_seq_client_enqueue_event()
    snd_seq_deliver_event()
      deliver_to_subscribers()
        snd_seq_deliver_single_event()
          snd_opl3_oss_event_input()
            snd_midi_process_event()
              do_control()

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent 25a0707c

sound/core/seq/seq_midi_emul.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -269,6 +269,9 @@ do_control(struct snd_midi_op ops, void drv, struct snd_midi_channel_set *chse
	{		{
	int i;		int i;

			if (control >= ARRAY_SIZE(chan->control))
			return;

	/* Switches */		/* Switches */
	if ((control >=64 && control <=69) \|\| (control >= 80 && control <= 83)) {		if ((control >=64 && control <=69) \|\| (control >= 80 && control <= 83)) {
	/* These are all switches; either off or on so set to 0 or 127 */		/* These are all switches; either off or on so set to 0 or 127 */