mirror of
https://github.com/torvalds/linux.git
synced 2024-11-08 13:11:45 +00:00
31ea49baa1
When detecting packet discontinuity, handle_in_packet() returns minus value
and this value is assigned to unsigned int variable, then the variable has
huge value. As a result, the variable causes buffer-over-run in
handle_out_packet(). This brings invalid page request and system hangup.
This commit fixes the bug to add a new argument into handle_in_packet()
and the number of handled data blocks is assignd to it. The function
return value is just used to check error.
I also considered to change the type of local variable to 'int' in
in_stream_callback(). This idea is based on type-conversion in C standard,
while it may cause future problems when adding more works. Thus, I dropped
this idea.
Fixes: 6fc6b9ce41c6('ALSA: firewire-lib: pass the number of data blocks in incoming packets to outgoing packets')
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
|---|---|---|
| .. | ||
| bebob | ||
| dice | ||
| fireworks | ||
| oxfw | ||
| amdtp.c | ||
| amdtp.h | ||
| cmp.c | ||
| cmp.h | ||
| fcp.c | ||
| fcp.h | ||
| isight.c | ||
| iso-resources.c | ||
| iso-resources.h | ||
| Kconfig | ||
| lib.c | ||
| lib.h | ||
| Makefile | ||
| packets-buffer.c | ||
| packets-buffer.h | ||
| scs1x.c | ||