Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d00135a authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Takashi Iwai
Browse files

sound/oss/opl3: validate voice and channel indexes 



User-controllable indexes for voice and channel values may cause reading
and writing beyond the bounds of their respective arrays, leading to
potentially exploitable memory corruption.  Validate these indexes.

Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent b769f494

sound/oss/opl3.c

+13 −2
Original line number Original line Diff line number Diff line
@@ -845,6 +845,10 @@ static int opl3_load_patch(int dev, int format, const char __user *addr, 




static void opl3_panning(int dev, int voice, int value)

static void opl3_panning(int dev, int voice, int value)

{

{



	if (voice < 0 || voice >= devc->nr_voice)

		return;



	devc->voc[voice].panning = value;

	devc->voc[voice].panning = value;

}

}
@@ -1062,8 +1066,15 @@ static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info 




static void opl3_setup_voice(int dev, int voice, int chn)

static void opl3_setup_voice(int dev, int voice, int chn)

{

{

	struct channel_info *info =

	struct channel_info *info;

	&synth_devs[dev]->chn_info[chn];



	if (voice < 0 || voice >= devc->nr_voice)

		return;



	if (chn < 0 || chn > 15)

		return;



	info = &synth_devs[dev]->chn_info[chn];





	opl3_set_instr(dev, voice, info->pgm_num);

	opl3_set_instr(dev, voice, info->pgm_num);