diff options
| author | Ingo Molnar <mingo@kernel.org> | 2016-08-10 14:36:23 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2016-08-10 14:36:23 +0200 |
| commit | fdbdfefbabefcdf3f57560163b43fdc4cf95eb2f (patch) | |
| tree | 1d0c420d4eaff48cf2486f10dded8d551241ee94 /sound/core/control.c | |
| parent | 6731b0d611a1274f9e785fa0189ac2aeeabd0591 (diff) | |
| parent | a0cba2179ea4c1820fce2ee046b6ed90ecc56196 (diff) | |
| download | linux-fdbdfefbabefcdf3f57560163b43fdc4cf95eb2f.tar.bz2 | |
Merge branch 'linus' into timers/urgent, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'sound/core/control.c')
| -rw-r--r-- | sound/core/control.c | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/sound/core/control.c b/sound/core/control.c index b4fe9b002512..fb096cb20a80 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -807,6 +807,36 @@ static int snd_ctl_elem_list(struct snd_card *card, return 0; } +static bool validate_element_member_dimension(struct snd_ctl_elem_info *info) +{ + unsigned int members; + unsigned int i; + + if (info->dimen.d[0] == 0) + return true; + + members = 1; + for (i = 0; i < ARRAY_SIZE(info->dimen.d); ++i) { + if (info->dimen.d[i] == 0) + break; + members *= info->dimen.d[i]; + + /* + * info->count should be validated in advance, to guarantee + * calculation soundness. + */ + if (members > info->count) + return false; + } + + for (++i; i < ARRAY_SIZE(info->dimen.d); ++i) { + if (info->dimen.d[i] > 0) + return false; + } + + return members == info->count; +} + static int snd_ctl_elem_info(struct snd_ctl_file *ctl, struct snd_ctl_elem_info *info) { @@ -1274,6 +1304,8 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, if (info->count < 1 || info->count > max_value_counts[info->type]) return -EINVAL; + if (!validate_element_member_dimension(info)) + return -EINVAL; private_size = value_sizes[info->type] * info->count; /* |