Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a7a13d06 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: rawmidi: fix the get next midi device ioctl 



If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then
the "next device" should be -1.  This function just returns device + 1.

But the main thing is that "device + 1" can lead to a (harmless) integer
overflow and that annoys static analysis tools.

[fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai]

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 27f7ad53

sound/core/rawmidi.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -829,6 +829,8 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card, 
		

		

		if (get_user(device, (int __user *)argp))

		if (get_user(device, (int __user *)argp))

			return -EFAULT;

			return -EFAULT;

		if (device >= SNDRV_RAWMIDI_DEVICES) /* next device is -1 */

			device = SNDRV_RAWMIDI_DEVICES - 1;

		mutex_lock(&register_mutex);

		mutex_lock(&register_mutex);

		device = device < 0 ? 0 : device + 1;

		device = device < 0 ? 0 : device + 1;

		while (device < SNDRV_RAWMIDI_DEVICES) {

		while (device < SNDRV_RAWMIDI_DEVICES) {