Commit 94f3ec6b authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai

sound: oss/sb_audio: prevent divide by zero bug

Speed comes from get_user() in audio_ioctl().  We use it to set the "s"
variable before clamping it to valid values so it could lead to a divide
by zero bug.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 5e68fb3c
...@@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed) ...@@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed)
if (speed > 0) if (speed > 0)
{ {
int tmp; int tmp;
int s = speed * devc->channels; int s;
if (speed < 5000) if (speed < 5000)
speed = 5000; speed = 5000;
if (speed > 44100) if (speed > 44100)
speed = 44100; speed = 44100;
s = speed * devc->channels;
devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff; devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff;
tmp = 256 - devc->tconst; tmp = 256 - devc->tconst;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment