projects / GitHub / LineageOS / G12 / android_kernel_amlogic_linux-4.9.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: f44f07c)
ALSA: opl3: small array underflow
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 5 Mar 2015 17:49:06 +0000 (20:49 +0300)
committerTakashi Iwai <tiwai@suse.de>
Fri, 6 Mar 2015 12:04:42 +0000 (13:04 +0100)
There is a missing lower bound check on "pitchbend" so it means we can
read up to 6 elements before the start of the opl3_note_table[] array.

Thanks to Clemens Ladisch for his help with this patch.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/drivers/opl3/opl3_midi.c patch | blob | blame | history

diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
index f62780ed64adcc85465447838ee3b5d794690937..7821b07415a785c70982e03803ac34601770e3a9 100644 (file)
--- a/sound/drivers/opl3/opl3_midi.c
+++ b/sound/drivers/opl3/opl3_midi.c
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,
                int pitchbend = chan->midi_pitchbend;
                int segment;
 
+               if (pitchbend < -0x2000)
+                       pitchbend = -0x2000;
                if (pitchbend > 0x1FFF)
                        pitchbend = 0x1FFF;