diff options
| author | Chirayu Desai <cdesai@cyanogenmod.org> | 2013-06-08 14:13:36 +0530 |
|---|---|---|
| committer | Chirayu Desai <cdesai@cyanogenmod.org> | 2013-06-08 14:13:36 +0530 |
| commit | 0ea6eab87c85317af3fc549950715b9e42795706 (patch) | |
| tree | 59668f4c72c2a3b5640ae212864013644b6911ce /sound | |
| parent | ad5ca4cbf2df1d5e30269097e57ddbf13d8c189d (diff) | |
| parent | 1e18293a23fdc4e28b07302ad6a5ed99f7a26348 (diff) | |
| download | kernel_samsung_aries-0ea6eab87c85317af3fc549950715b9e42795706.zip kernel_samsung_aries-0ea6eab87c85317af3fc549950715b9e42795706.tar.gz kernel_samsung_aries-0ea6eab87c85317af3fc549950715b9e42795706.tar.bz2 | |
Merge tag 'v3.0.81' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into HEAD
This is the 3.0.81 stable release
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/card.h | 1 | ||||
| -rw-r--r-- | sound/usb/format.c | 6 | ||||
| -rw-r--r-- | sound/usb/quirks.c | 6 |
3 files changed, 11 insertions, 2 deletions
diff --git a/sound/usb/card.h b/sound/usb/card.h index 19b5b5d..da61252 100644 --- a/sound/usb/card.h +++ b/sound/usb/card.h @@ -1,6 +1,7 @@ #ifndef __USBAUDIO_CARD_H #define __USBAUDIO_CARD_H +#define MAX_NR_RATES 1024 #define MAX_PACKS 20 #define MAX_PACKS_HS (MAX_PACKS * 8) /* in high speed mode */ #define MAX_URBS 8 diff --git a/sound/usb/format.c b/sound/usb/format.c index 8d042dc..b30fcd0 100644 --- a/sound/usb/format.c +++ b/sound/usb/format.c @@ -226,7 +226,7 @@ static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets, int min = combine_quad(&data[2 + 12 * i]); int max = combine_quad(&data[6 + 12 * i]); int res = combine_quad(&data[10 + 12 * i]); - int rate; + unsigned int rate; if ((max < 0) || (min < 0) || (res < 0) || (max < min)) continue; @@ -253,6 +253,10 @@ static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets, fp->rates |= snd_pcm_rate_to_rate_bit(rate); nr_rates++; + if (nr_rates >= MAX_NR_RATES) { + snd_printk(KERN_ERR "invalid uac2 rates\n"); + break; + } /* avoid endless loop */ if (res == 0) diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index eb22768..4a650ab 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -131,10 +131,14 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip, unsigned *rate_table = NULL; fp = kmemdup(quirk->data, sizeof(*fp), GFP_KERNEL); - if (! fp) { + if (!fp) { snd_printk(KERN_ERR "cannot memdup\n"); return -ENOMEM; } + if (fp->nr_rates > MAX_NR_RATES) { + kfree(fp); + return -EINVAL; + } if (fp->nr_rates > 0) { rate_table = kmalloc(sizeof(int) * fp->nr_rates, GFP_KERNEL); if (!rate_table) { |