Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 94f3ec6b2222eb5c0af0c784f0656ff5b909d870

Authored by Dan Carpenter
Committed by Takashi Iwai
1 parent 5e68fb3cab
Exists in master and in 20 other branches dlt-processor-sdk-linux-03.00.00.04, newt-ti-linux-3.12.y, processor-sdk-linux-01.00.00, processor-sdk-linux-02.00.01, smarc-ti-linux-3.12.10, smarc-ti-linux-3.12.y, smarc-ti-linux-3.14.y, smarc-ti-linux-3.15.y, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04, ti-linux-3.12.y, ti-linux-3.14.y, ti-linux-3.15.y, ti-lsk-linux-4.1.y

sound: oss/sb_audio: prevent divide by zero bug 

Speed comes from get_user() in audio_ioctl().  We use it to set the "s"
variable before clamping it to valid values so it could lead to a divide
by zero bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Showing 1 changed file with 3 additions and 1 deletions Side-by-side Diff

sound/oss/sb_audio.c
Diff comments   View file @ 94f3ec6
... ... @@ -575,12 +575,14 @@
575 575 if (speed > 0)
576 576 {
577 577 int tmp;
578   - int s = speed * devc->channels;
  578 + int s;
579 579  
580 580 if (speed < 5000)
581 581 speed = 5000;
582 582 if (speed > 44100)
583 583 speed = 44100;
  584 +
  585 + s = speed * devc->channels;
584 586  
585 587 devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff;
586 588