Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77008b70 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: echoaudio: read past end of array 



We need to cap "ucontrol->id.index / num_busses_in(chip)" so the we
don't read beyond the end of the array.

I also adding a check on "in" and changing the type in
snd_echo_mixer_put() from short to unsigned int. Those changes are done
for symmetry and are cosmetic.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 034f90b3

sound/pci/echoaudio/echoaudio.c

+10 −6
Original line number Diff line number Diff line
@@ -1283,12 +1283,14 @@ static int snd_echo_mixer_info(struct snd_kcontrol *kcontrol, 
static int snd_echo_mixer_get(struct snd_kcontrol *kcontrol,

			      struct snd_ctl_elem_value *ucontrol)

{

	struct echoaudio *chip;

	struct echoaudio *chip = snd_kcontrol_chip(kcontrol);

	unsigned int out = ucontrol->id.index / num_busses_in(chip);

	unsigned int in = ucontrol->id.index % num_busses_in(chip);



	chip = snd_kcontrol_chip(kcontrol);

	ucontrol->value.integer.value[0] =

		chip->monitor_gain[ucontrol->id.index / num_busses_in(chip)]

			[ucontrol->id.index % num_busses_in(chip)];

	if (out >= ECHO_MAXAUDIOOUTPUTS || in >= ECHO_MAXAUDIOINPUTS)

		return -EINVAL;



	ucontrol->value.integer.value[0] = chip->monitor_gain[out][in];

	return 0;

}
@@ -1297,12 +1299,14 @@ static int snd_echo_mixer_put(struct snd_kcontrol *kcontrol, 
{

	struct echoaudio *chip;

	int changed,  gain;

	short out, in;

	unsigned int out, in;



	changed = 0;

	chip = snd_kcontrol_chip(kcontrol);

	out = ucontrol->id.index / num_busses_in(chip);

	in = ucontrol->id.index % num_busses_in(chip);

	if (out >= ECHO_MAXAUDIOOUTPUTS || in >= ECHO_MAXAUDIOINPUTS)

		return -EINVAL;

	gain = ucontrol->value.integer.value[0];

	if (gain < ECHOGAIN_MINOUT || gain > ECHOGAIN_MAXOUT)

		return -EINVAL;