diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-09-13 11:07:13 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-09-17 07:39:28 -0700 |
| commit | c3cb718acc17f8e0d6b4b8d1f8ca9a20d1999159 (patch) | |
| tree | 79b45433fe399c666f99e5e939b7dca89f18c5d2 /drivers/staging | |
| parent | 650433b8b1a4a4a46250ad0c8f68b2e47671914d (diff) | |
| download | linux-c3cb718acc17f8e0d6b4b8d1f8ca9a20d1999159.tar.bz2 | |
staging: line6: add bounds check in snd_toneport_source_put()
"source" comes from the user in snd_ctl_elem_write() so it needs to be
checked.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/line6/toneport.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/staging/line6/toneport.c b/drivers/staging/line6/toneport.c index 2f44d56700af..776d3632dc7d 100644 --- a/drivers/staging/line6/toneport.c +++ b/drivers/staging/line6/toneport.c @@ -244,13 +244,17 @@ static int snd_toneport_source_put(struct snd_kcontrol *kcontrol, struct snd_line6_pcm *line6pcm = snd_kcontrol_chip(kcontrol); struct usb_line6_toneport *toneport = (struct usb_line6_toneport *)line6pcm->line6; + unsigned int source; - if (ucontrol->value.enumerated.item[0] == toneport->source) + source = ucontrol->value.enumerated.item[0]; + if (source >= ARRAY_SIZE(toneport_source_info)) + return -EINVAL; + if (source == toneport->source) return 0; - toneport->source = ucontrol->value.enumerated.item[0]; + toneport->source = source; toneport_send_cmd(toneport->line6.usbdev, - toneport_source_info[toneport->source].code, 0x0000); + toneport_source_info[source].code, 0x0000); return 1; } |