sound: oss/sb_audio: cap value in sb201_audio_set_speed()
Subsystems (2)
PATCH 1/1 sound: oss/sb_audio: cap value in sb201_audio_set_speed()
We set "s" before we have capped "speed" so it could be the wrong value. This could lead to a divide by zero bug.
Signed-off-by Dan Carpenter <[email protected]>
---
I fixed a similar bug in this file in Aug. I'm not sure how I missed this one. I don't see any others I missed.
sound/oss/sb_audio.c +2 -1
@@ -442,7 +442,7 @@ static int sb201_audio_set_speed(int dev, int speed) {sb_devc *devc = audio_devs[dev]->devc;int tmp; -int s = speed * devc->channels; +int s;if (speed >0 ) {
@@ -452,6 +452,7 @@ static int sb201_audio_set_speed(int dev, int speed) speed =44100 ;if (devc->opened &OPEN_READ && speed >15000 ) speed =15000 ; + s = speed * devc->channels; devc->tconst = (256 - ((1000000 + s /2 ) / s)) &0xff ; tmp =256 - devc->tconst; speed = ((1000000 + tmp /2 ) / tmp) / devc->channels;
Takashi Iwai
AppliedAt Sat, 17 Nov 2012 18:08:57 +0300,
Quoted 8 lines · Dan Carpenter
We set "s" before we have capped "speed" so it could be the wrong value. This could lead to a divide by zero bug.
Signed-off-by Dan Carpenter <[email protected]>---
I fixed a similar bug in this file in Aug. I'm not sure how I missed this one. I don't see any others I missed.
Thanks, applied.
Takashi
Quoted 23 lines
sound/oss/sb_audio.c +2
-1@@ -442,7 +442,7 @@ static int sb201_audio_set_speed(int dev, int speed) {sb_devc *devc = audio_devs[dev]->devc;int tmp; -int s = speed * devc->channels; +int s;if (speed >0 ) {@@ -452,6 +452,7 @@ static int sb201_audio_set_speed(int dev, int speed) speed =44100 ;if (devc->opened &OPEN_READ && speed >15000 ) speed =15000 ; + s = speed * devc->channels; devc->tconst = (256 - ((1000000 + s /2 ) / s)) &0xff ; tmp =256 - devc->tconst; speed = ((1000000 + tmp /2 ) / tmp) / devc->channels;