Commit 4dc040a0 authored by Vinod Koul's avatar Vinod Koul Committed by Takashi Iwai

ALSA: compress - move the buffer check

Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()
added a new error check for input params.
this add new routine for input checks and moves buffer overflow check to this
new routine. This allows the error value to be propogated to user space
Signed-off-by: default avatarVinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent e5d6db8e
...@@ -407,10 +407,6 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream, ...@@ -407,10 +407,6 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
unsigned int buffer_size; unsigned int buffer_size;
void *buffer; void *buffer;
if (params->buffer.fragment_size == 0 ||
params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
return -EINVAL;
buffer_size = params->buffer.fragment_size * params->buffer.fragments; buffer_size = params->buffer.fragment_size * params->buffer.fragments;
if (stream->ops->copy) { if (stream->ops->copy) {
buffer = NULL; buffer = NULL;
...@@ -429,6 +425,16 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream, ...@@ -429,6 +425,16 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
return 0; return 0;
} }
static int snd_compress_check_input(struct snd_compr_params *params)
{
/* first let's check the buffer parameter's */
if (params->buffer.fragment_size == 0 ||
params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
return -EINVAL;
return 0;
}
static int static int
snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
{ {
...@@ -447,11 +453,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) ...@@ -447,11 +453,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
retval = -EFAULT; retval = -EFAULT;
goto out; goto out;
} }
retval = snd_compress_check_input(params);
if (retval)
goto out;
retval = snd_compr_allocate_buffer(stream, params); retval = snd_compr_allocate_buffer(stream, params);
if (retval) { if (retval) {
retval = -ENOMEM; retval = -ENOMEM;
goto out; goto out;
} }
retval = stream->ops->set_params(stream, params); retval = stream->ops->set_params(stream, params);
if (retval) if (retval)
goto out; goto out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment