ALSA: opl3: small array underflow
Subsystems (2)
PATCH v3 1/1 ALSA: opl3: small array underflow
There is a missing lower bound check on "pitchbend" so it means we can read up to 6 elements before the start of the opl3_note_table[] array.
Thanks to Clemens Ladisch for his help with this patch.
Signed-off-by Dan Carpenter <[email protected]>
---
v3: The first two versions of this broke the user space API.
sound/drivers/opl3/opl3_midi.c +2 -0
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,int pitchbend = chan->midi_pitchbend;int segment; +if (pitchbend <-0x2000 ) + pitchbend =-0x2000 ;if (pitchbend >0x1FFF ) pitchbend =0x1FFF ;
Takashi Iwai
AppliedAt Thu, 5 Mar 2015 20:49:06 +0300,
Quoted 9 lines · Dan Carpenter
There is a missing lower bound check on "pitchbend" so it means we can read up to 6 elements before the start of the opl3_note_table[] array.
Thanks to Clemens Ladisch for his help with this patch.
Signed-off-by Dan Carpenter <[email protected]>---
v3: The first two versions of this broke the user space API.
Applied, thanks.
Takashi
Quoted 15 lines
sound/drivers/opl3/opl3_midi.c +2
-0@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,int pitchbend = chan->midi_pitchbend;int segment; +if (pitchbend <-0x2000 ) + pitchbend =-0x2000 ;if (pitchbend >0x1FFF ) pitchbend =0x1FFF ;