diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2013-03-04 15:19:18 +0300 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2013-03-04 16:39:50 +0100 |
commit | 85c50a5899b23f4f893b0898b286023157b98376 (patch) | |
tree | 4b47c49fc31685ca10b7f48ed6a75b64703b7694 /ipc/ipc_sysctl.c | |
parent | 6dbe51c251a327e012439c4772097a13df43c5b8 (diff) |
ALSA: seq: seq_oss_event: missing range checks
The "dev" variable could be out of bounds. Calling
snd_seq_oss_synth_is_valid() checks that it is is a valid device
which has been opened. We check this inside set_note_event() so
this function can't succeed without a valid "dev". But we need to
do the check earlier to prevent invalid dereferences and memory
corruption.
One call tree where "dev" could be out of bounds is:
-> snd_seq_oss_oob_user()
-> snd_seq_oss_process_event()
-> extended_event()
-> note_on_event()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'ipc/ipc_sysctl.c')
0 files changed, 0 insertions, 0 deletions