kevin/linux
1
Fork 0
Code

ALSA: emux: improve patch ioctl data validation

Browse Source 
In load_data(), make the validation of and skipping over the main info
block match that in load_guspatch().

In load_guspatch(), add checking that the specified patch length matches
the actually supplied data, like load_data() already did.

Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
Message-ID: <20240406064830.1029573-8-oswald.buddenhagen@gmx.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Oswald Buddenhagen 2024-04-06 08:48:20 +02:00 committed by Takashi Iwai
parent de67aab120
commit 89b32ccb12
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sound/synth/emux/soundfont.c
View File

@ -716,7 +716,6 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count)
struct snd_soundfont *sf;
struct soundfont_sample_info sample_info;
struct snd_sf_sample *sp;
long off;
/* patch must be opened */
sf = sflist->currsf;
@ -726,12 +725,16 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count)
if (is_special_type(sf->type))
return -EINVAL;
if (count < (long)sizeof(sample_info)) {
return -EINVAL;
}
if (copy_from_user(&sample_info, data, sizeof(sample_info)))
return -EFAULT;
data += sizeof(sample_info);
count -= sizeof(sample_info);
off = sizeof(sample_info);
if (sample_info.size != (count-off)/2)
// SoundFont uses S16LE samples.
if (sample_info.size * 2 != count)
return -EINVAL;
/* Check for dup */
@ -774,7 +777,7 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count)
int rc;
rc = sflist->callback.sample_new
(sflist->callback.private_data, sp, sflist->memhdr,
data + off, count - off);
data, count);
if (rc < 0) {
sf_sample_delete(sflist, sf, sp);
return rc;
@ -986,10 +989,12 @@ load_guspatch(struct snd_sf_list *sflist, const char __user *data, long count)
}
if (copy_from_user(&patch, data, sizeof(patch)))
return -EFAULT;
count -= sizeof(patch);
data += sizeof(patch);
if ((patch.len << (patch.mode & WAVE_16_BITS ? 1 : 0)) != count)
return -EINVAL;
sf = newsf(sflist, SNDRV_SFNT_PAT_TYPE_GUS|SNDRV_SFNT_PAT_SHARED, NULL);
if (sf == NULL)
return -ENOMEM;