Commit 94f3ec6b authored Aug 18, 2012 by Dan Carpenter Committed by Takashi Iwai Aug 20, 2012

sound: oss/sb_audio: prevent divide by zero bug



Speed comes from get_user() in audio_ioctl().  We use it to set the "s"
variable before clamping it to valid values so it could lead to a divide
by zero bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent 5e68fb3c

sound/oss/sb_audio.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed)
		if (speed > 0)
		{
		int tmp;
		int s = speed * devc->channels;
		int s;

		if (speed < 5000)
		speed = 5000;
		if (speed > 44100)
		speed = 44100;

		s = speed * devc->channels;

		devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff;

		tmp = 256 - devc->tconst;