ALSA: fireface: Off by one in latter_handle_midi_msg()

PATCH In review Dan Carpenter 3 participants 3 messages Jan 25, 2019

Subsystems (3)

Sound Kernel janitors Firewire audio drivers and IEC 61883-1/6 packet streaming engine

lore

Share & tools

lore

Dan Carpenter

author

2019-01-25 12:44 UTC #0 lore raw

PATCH 1/1 ALSA: fireface: Off by one in latter_handle_midi_msg()

The > should be >= or otherwise we potentially read one element beyond the end of the ff->tx_midi_substreams[] array.

Fixes 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")

Signed-off-by Dan Carpenter <[email protected]>

---
 sound/firewire/fireface/ff-protocol-latter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

sound/firewire/fireface/ff-protocol-latter.c +1 -1

index 817af4447349..438aeed9a1ab 100644
@@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
 	struct snd_rawmidi_substream *substream;
 	unsigned int len;
 
-	if (index > ff->spec->midi_in_ports)
+	if (index >= ff->spec->midi_in_ports)
 		return;
 
 	switch (data & 0x0000000f) {

Signature · 1 line

2.17.1

Takashi Sakamoto

maintainer Reviewed-by on v1 1/1

2019-01-25 13:41 UTC #1 lore raw

Quoted 24 lines · Dan Carpenter

The > should be >= or otherwise we potentially read one element beyond the end of the ff->tx_midi_substreams[] array.
Fixes 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
Signed-off-by Dan Carpenter <[email protected]>
---
 sound/firewire/fireface/ff-protocol-latter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/firewire/fireface/ff-protocol-latter.c +1 -1
index 817af4447349..438aeed9a1ab 100644
@@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
 	struct snd_rawmidi_substream *substream;
 	unsigned int len;
 
-	if (index > ff->spec->midi_in_ports)
+	if (index >= ff->spec->midi_in_ports)
 		return;
 
 	switch (data & 0x0000000f) {
Signature · 1 line
2.17.1

Indeed. The value of index is picked up from quadlet data transferred by device. The range of value is expected to be 0x00 or 0x01, thus this patch is correct.

Reviewed-by Takashi Sakamoto <[email protected]>

Thanks

Takashi Sakamoto

Takashi Iwai

2019-01-25 14:52 UTC #2 lore raw

Quoted 31 lines · Takashi Sakamoto

Quoted 24 lines · Dan Carpenter
The > should be >= or otherwise we potentially read one element beyond the end of the ff->tx_midi_substreams[] array.
Fixes 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
Signed-off-by Dan Carpenter <[email protected]>
---
 sound/firewire/fireface/ff-protocol-latter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/firewire/fireface/ff-protocol-latter.c +1 -1
index 817af4447349..438aeed9a1ab 100644
@@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
 	struct snd_rawmidi_substream *substream;
 	unsigned int len;
 
-	if (index > ff->spec->midi_in_ports)
+	if (index >= ff->spec->midi_in_ports)
 		return;
 
 	switch (data & 0x0000000f) {
Signature · 1 line
2.17.1
Indeed. The value of index is picked up from quadlet data transferred by device. The range of value is expected to be 0x00 or 0x01, thus this patch is correct.

Quoted 1 line

Reviewed-by Takashi Sakamoto <[email protected]>

Applied now. Thanks.

Takashi