Skip to contentSkip to conversation

ALSA: opl3: small array underflow

PATCH Applied Dan Carpenter 2 participants 2 messages Mar 5, 2015 – Mar 6, 2015

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH v3 1/1 ALSA: opl3: small array underflow

There is a missing lower bound check on "pitchbend" so it means we can read up to 6 elements before the start of the opl3_note_table[] array.

Thanks to Clemens Ladisch for his help with this patch.

---
v3: The first two versions of this broke the user space API.

sound/drivers/opl3/opl3_midi.c +2 -0
index f62780e..7821b07 100644
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,
 		int pitchbend = chan->midi_pitchbend;
 		int segment;
 
+		if (pitchbend < -0x2000)
+			pitchbend = -0x2000;
 		if (pitchbend > 0x1FFF)
 			pitchbend = 0x1FFF;
 
Applied
#1 lore raw

At Thu, 5 Mar 2015 20:49:06 +0300,

Quoted 9 lines · Dan Carpenter

There is a missing lower bound check on "pitchbend" so it means we can read up to 6 elements before the start of the opl3_note_table[] array.

Thanks to Clemens Ladisch for his help with this patch.

---
v3: The first two versions of this broke the user space API.

Applied, thanks.

Takashi

Quoted 15 lines
sound/drivers/opl3/opl3_midi.c +2 -0
index f62780e..7821b07 100644
@@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum,
 		int pitchbend = chan->midi_pitchbend;
 		int segment;
 
+		if (pitchbend < -0x2000)
+			pitchbend = -0x2000;
 		if (pitchbend > 0x1FFF)
 			pitchbend = 0x1FFF;