Signed-off-by: Vinod Koul vinod.koul@linux.intel.com --- include/sound/compress_params.h | 1 + sound/core/compress_offload.c | 10 ++++++++++ 2 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/include/sound/compress_params.h b/include/sound/compress_params.h index da4a456..602dc6c 100644 --- a/include/sound/compress_params.h +++ b/include/sound/compress_params.h @@ -72,6 +72,7 @@ #define SND_AUDIOCODEC_IEC61937 ((__u32) 0x0000000B) #define SND_AUDIOCODEC_G723_1 ((__u32) 0x0000000C) #define SND_AUDIOCODEC_G729 ((__u32) 0x0000000D) +#define SND_AUDIOCODEC_MAX SND_AUDIOCODEC_G729

/* * Profile and modes are listed with bit masks. This allows for a diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index bd7f28e..c40ae57 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -432,6 +432,16 @@ static int snd_compress_check_input(struct snd_compr_params *params) params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size) return -EINVAL;

+ /* now codec parameters */ + if (params->codec.id == 0 || params->codec.id > SND_AUDIOCODEC_MAX) + return -EINVAL; + + if (params->codec.ch_in == 0 || params->codec.ch_out == 0) + return -EINVAL; + + if (!(params->codec.sample_rate & SNDRV_PCM_RATE_8000_192000)) + return -EINVAL; + return 0; }

At Mon, 17 Sep 2012 11:51:25 +0530, Vinod Koul wrote:

Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer() added a new error check for input params. this add new routine for input checks and moves buffer overflow check to this new routine. This allows the error value to be propogated to user space

Signed-off-by: Vinod Koul vinod.koul@linux.intel.com

Applied, thanks.

Takashi

---

sound/core/compress_offload.c | 20 ++++++++++++++++---- 1 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 68fe02c..bd7f28e 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -407,10 +407,6 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream, unsigned int buffer_size; void *buffer;

• if (params->buffer.fragment_size == 0 ||

•    params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
  

• return -EINVAL;
  

• buffer_size = params->buffer.fragment_size * params->buffer.fragments; if (stream->ops->copy) { buffer = NULL;

@@ -429,6 +425,16 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream, return 0; }

+static int snd_compress_check_input(struct snd_compr_params *params) +{

• /* first let's check the buffer parameter's */
• if (params->buffer.fragment_size == 0 ||

• 	params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
  

• return -EINVAL;
  

• return 0;

+}

static int snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) { @@ -447,11 +453,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg) retval = -EFAULT; goto out; }

• retval = snd_compress_check_input(params);
  

• if (retval)
  

• 	goto out;
  

• retval = snd_compr_allocate_buffer(stream, params); if (retval) { retval = -ENOMEM; goto out; }
• retval = stream->ops->set_params(stream, params); if (retval) goto out;

-- 1.7.0.4