ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
3 Feb
2023
3 Feb
'23
7 a.m.
In snd_emux_control() method "snd_emux_port" can be passed with field chset.midi_mode == SNDRV_MIDI_MODE_XG. The "type" can be MIDI_CTL_PITCHBEND or MIDI_CTL_CHAN_PRESSURE. It may lead to accessing 'control' array of size 128 with MIDI_CTL_PITCHBEND (0x80) or MIDI_CTL_CHAN_PRESSURE (0x82) index. How can we prevent this? Would it be a good solution to place code like this before call snd_emux_xg_control()? if (type == MIDI_CTL_PITCHBEND || type == MIDI_CTL_CHAN_PRESSURE){ return; } Found by Linux Verification Center (linuxtesting.org) with SVACE.
688
Age (days ago)
688
Last active (days ago)
0 comments
1 participants
participants (1)
-
Артемий Карасев