Skip to content

Commit

Permalink
ALSA: emux: stop if copy_from_user() fails
Browse files Browse the repository at this point in the history
If we can't fill the "patch" struct because "count" is too small (it can
be as low as 4 bytes) or because copy_from_user() failed, then just
return instead of using unintialized data.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Dan Carpenter authored and tiwai committed Mar 31, 2017
1 parent 03a1f48 commit 5885615
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions sound/synth/emux/emux_oss.c
Original file line number Diff line number Diff line change
Expand Up @@ -225,9 +225,9 @@ snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format,
else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {
struct soundfont_patch_info patch;
if (count < (int)sizeof(patch))
rc = -EINVAL;
return -EINVAL;
if (copy_from_user(&patch, buf, sizeof(patch)))
rc = -EFAULT;
return -EFAULT;
if (patch.type >= SNDRV_SFNT_LOAD_INFO &&
patch.type <= SNDRV_SFNT_PROBE_DATA)
rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));
Expand Down

0 comments on commit 5885615

Please sign in to comment.