diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-09-14 02:01:16 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2017-09-18 15:42:00 +0200 |
| commit | c4fd43793bdecb986bfc80e00c8792556c3f1c7f (patch) | |
| tree | e849b0888399fef03c76faeff5c1af13227f5900 /sound | |
| parent | 2bd6bf03f4c1c59381d62c61d03f6cc3fe71f66e (diff) | |
| download | op-kernel-dev-c4fd43793bdecb986bfc80e00c8792556c3f1c7f.zip op-kernel-dev-c4fd43793bdecb986bfc80e00c8792556c3f1c7f.tar.gz | |
ALSA: hwdep: prevent a harmless shift wrapping bug
The "info.index" variable represents a bit in hw->dsp_loaded which is
an unsigned int. If it's higher than 31 we hit a shift wrapping bug.
This seems harmless, but I wanted to silence the static checker warning.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/hwdep.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c index a73baa1..8faae3d 100644 --- a/sound/core/hwdep.c +++ b/sound/core/hwdep.c @@ -228,6 +228,8 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw, memset(&info, 0, sizeof(info)); if (copy_from_user(&info, _info, sizeof(info))) return -EFAULT; + if (info.index >= 32) + return -EINVAL; /* check whether the dsp was already loaded */ if (hw->dsp_loaded & (1 << info.index)) return -EBUSY; |
