Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-24 21:21:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: emu10k1: validate min/max values of translated controls

Browse Source 
User space could pass arbitrary ranges, which were uncritically
accepted. This could lead to table lookups out of range.

I don't think that this is a security issue, as it only allowed someone
with CAP_SYS_ADMIN to crash the kernel, but still.

Setting an invalid translation mode will also be rejected now. That did
no harm, but it's still better to detect errors.

Signed-off-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de>
Link: https://lore.kernel.org/r/20230514170323.3408834-4-oswald.buddenhagen@gmx.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Oswald Buddenhagen 2023-05-14 19:03:19 +02:00 committed by Takashi Iwai
parent bb5ceb43b7
commit 1a38ae5796
1 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
sound/pci/emu10k1/emufx.c
View File

@ -769,6 +769,32 @@ static int snd_emu10k1_verify_controls(struct snd_emu10k1 *emu,
err = -EINVAL;
goto __error;
}
switch (gctl->translation) {
case EMU10K1_GPR_TRANSLATION_NONE:
break;
case EMU10K1_GPR_TRANSLATION_TABLE100:
if (gctl->min != 0 || gctl->max != 100) {
err = -EINVAL;
goto __error;
}
break;
case EMU10K1_GPR_TRANSLATION_BASS:
case EMU10K1_GPR_TRANSLATION_TREBLE:
if (gctl->min != 0 || gctl->max != 40) {
err = -EINVAL;
goto __error;
}
break;
case EMU10K1_GPR_TRANSLATION_ONOFF:
if (gctl->min != 0 || gctl->max != 1) {
err = -EINVAL;
goto __error;
}
break;
default:
err = -EINVAL;
goto __error;
}
}
for (i = 0; i < icode->gpr_list_control_count; i++) {
/* FIXME: we need to check the WRITE access */