Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c3cb718a authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: line6: add bounds check in snd_toneport_source_put() 



"source" comes from the user in snd_ctl_elem_write() so it needs to be
checked.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarStefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 650433b8

drivers/staging/line6/toneport.c

+7 −3
Original line number Original line Diff line number Diff line
@@ -244,13 +244,17 @@ static int snd_toneport_source_put(struct snd_kcontrol *kcontrol, 
	struct snd_line6_pcm *line6pcm = snd_kcontrol_chip(kcontrol);

	struct snd_line6_pcm *line6pcm = snd_kcontrol_chip(kcontrol);

	struct usb_line6_toneport *toneport =

	struct usb_line6_toneport *toneport =

	    (struct usb_line6_toneport *)line6pcm->line6;

	    (struct usb_line6_toneport *)line6pcm->line6;

	unsigned int source;





	if (ucontrol->value.enumerated.item[0] == toneport->source)

	source = ucontrol->value.enumerated.item[0];

	if (source >= ARRAY_SIZE(toneport_source_info))

		return -EINVAL;

	if (source == toneport->source)

		return 0;

		return 0;





	toneport->source = ucontrol->value.enumerated.item[0];

	toneport->source = source;

	toneport_send_cmd(toneport->line6.usbdev,

	toneport_send_cmd(toneport->line6.usbdev,

			  toneport_source_info[toneport->source].code, 0x0000);

			  toneport_source_info[source].code, 0x0000);

	return 1;

	return 1;

}

}