From d05ab185b770de96399766be6bcb5769ab99bc09 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 15 Nov 2007 16:13:32 +0100 Subject: [ALSA] vxpocket - Check value range in ctl callbacks Check the value ranges in ctl put callbacks in vxpocket driver. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela --- sound/drivers/vx/vx_mixer.c | 67 ++++++++++++++++++++++++++++++++------------- sound/pcmcia/vx/vxp_mixer.c | 11 ++++++-- 2 files changed, 56 insertions(+), 22 deletions(-) (limited to 'sound') diff --git a/sound/drivers/vx/vx_mixer.c b/sound/drivers/vx/vx_mixer.c index b8fcd79..a37f0a8 100644 --- a/sound/drivers/vx/vx_mixer.c +++ b/sound/drivers/vx/vx_mixer.c @@ -439,14 +439,19 @@ static int vx_output_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_ele { struct vx_core *chip = snd_kcontrol_chip(kcontrol); int codec = kcontrol->id.index; + unsigned int val[2], vmax; + + vmax = chip->hw->output_level_max; + val[0] = ucontrol->value.integer.value[0]; + val[1] = ucontrol->value.integer.value[1]; + if (val[0] > vmax || val[1] > vmax) + return -EINVAL; mutex_lock(&chip->mixer_mutex); - if (ucontrol->value.integer.value[0] != chip->output_level[codec][0] || - ucontrol->value.integer.value[1] != chip->output_level[codec][1]) { - vx_set_analog_output_level(chip, codec, - ucontrol->value.integer.value[0], - ucontrol->value.integer.value[1]); - chip->output_level[codec][0] = ucontrol->value.integer.value[0]; - chip->output_level[codec][1] = ucontrol->value.integer.value[1]; + if (val[0] != chip->output_level[codec][0] || + val[1] != chip->output_level[codec][1]) { + vx_set_analog_output_level(chip, codec, val[0], val[1]); + chip->output_level[codec][0] = val[0]; + chip->output_level[codec][1] = val[1]; mutex_unlock(&chip->mixer_mutex); return 1; } @@ -506,6 +511,14 @@ static int vx_audio_src_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v static int vx_audio_src_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { struct vx_core *chip = snd_kcontrol_chip(kcontrol); + + if (chip->type >= VX_TYPE_VXPOCKET) { + if (ucontrol->value.enumerated.item[0] > 2) + return -EINVAL; + } else { + if (ucontrol->value.enumerated.item[0] > 1) + return -EINVAL; + } mutex_lock(&chip->mixer_mutex); if (chip->audio_source_target != ucontrol->value.enumerated.item[0]) { chip->audio_source_target = ucontrol->value.enumerated.item[0]; @@ -554,6 +567,9 @@ static int vx_clock_mode_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ static int vx_clock_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { struct vx_core *chip = snd_kcontrol_chip(kcontrol); + + if (ucontrol->value.enumerated.item[0] > 2) + return -EINVAL; mutex_lock(&chip->mixer_mutex); if (chip->clock_mode != ucontrol->value.enumerated.item[0]) { chip->clock_mode = ucontrol->value.enumerated.item[0]; @@ -603,12 +619,17 @@ static int vx_audio_gain_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ struct vx_core *chip = snd_kcontrol_chip(kcontrol); int audio = kcontrol->private_value & 0xff; int capture = (kcontrol->private_value >> 8) & 1; + unsigned int val[2]; + val[0] = ucontrol->value.integer.value[0]; + val[1] = ucontrol->value.integer.value[1]; + if (val[0] > CVAL_MAX || val[1] > CVAL_MAX) + return -EINVAL; mutex_lock(&chip->mixer_mutex); - if (ucontrol->value.integer.value[0] != chip->audio_gain[capture][audio] || - ucontrol->value.integer.value[1] != chip->audio_gain[capture][audio+1]) { - vx_set_audio_gain(chip, audio, capture, ucontrol->value.integer.value[0]); - vx_set_audio_gain(chip, audio+1, capture, ucontrol->value.integer.value[1]); + if (val[0] != chip->audio_gain[capture][audio] || + val[1] != chip->audio_gain[capture][audio+1]) { + vx_set_audio_gain(chip, audio, capture, val[0]); + vx_set_audio_gain(chip, audio+1, capture, val[1]); mutex_unlock(&chip->mixer_mutex); return 1; } @@ -632,13 +653,19 @@ static int vx_audio_monitor_put(struct snd_kcontrol *kcontrol, struct snd_ctl_el { struct vx_core *chip = snd_kcontrol_chip(kcontrol); int audio = kcontrol->private_value & 0xff; + unsigned int val[2]; + + val[0] = ucontrol->value.integer.value[0]; + val[1] = ucontrol->value.integer.value[1]; + if (val[0] > CVAL_MAX || val[1] > CVAL_MAX) + return -EINVAL; mutex_lock(&chip->mixer_mutex); - if (ucontrol->value.integer.value[0] != chip->audio_monitor[audio] || - ucontrol->value.integer.value[1] != chip->audio_monitor[audio+1]) { - vx_set_monitor_level(chip, audio, ucontrol->value.integer.value[0], + if (val[0] != chip->audio_monitor[audio] || + val[1] != chip->audio_monitor[audio+1]) { + vx_set_monitor_level(chip, audio, val[0], chip->audio_monitor_active[audio]); - vx_set_monitor_level(chip, audio+1, ucontrol->value.integer.value[1], + vx_set_monitor_level(chip, audio+1, val[1], chip->audio_monitor_active[audio+1]); mutex_unlock(&chip->mixer_mutex); return 1; @@ -669,8 +696,10 @@ static int vx_audio_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_va mutex_lock(&chip->mixer_mutex); if (ucontrol->value.integer.value[0] != chip->audio_active[audio] || ucontrol->value.integer.value[1] != chip->audio_active[audio+1]) { - vx_set_audio_switch(chip, audio, ucontrol->value.integer.value[0]); - vx_set_audio_switch(chip, audio+1, ucontrol->value.integer.value[1]); + vx_set_audio_switch(chip, audio, + !!ucontrol->value.integer.value[0]); + vx_set_audio_switch(chip, audio+1, + !!ucontrol->value.integer.value[1]); mutex_unlock(&chip->mixer_mutex); return 1; } @@ -699,9 +728,9 @@ static int vx_monitor_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ if (ucontrol->value.integer.value[0] != chip->audio_monitor_active[audio] || ucontrol->value.integer.value[1] != chip->audio_monitor_active[audio+1]) { vx_set_monitor_level(chip, audio, chip->audio_monitor[audio], - ucontrol->value.integer.value[0]); + !!ucontrol->value.integer.value[0]); vx_set_monitor_level(chip, audio+1, chip->audio_monitor[audio+1], - ucontrol->value.integer.value[1]); + !!ucontrol->value.integer.value[1]); mutex_unlock(&chip->mixer_mutex); return 1; } diff --git a/sound/pcmcia/vx/vxp_mixer.c b/sound/pcmcia/vx/vxp_mixer.c index 1eff158..bf9d3b3 100644 --- a/sound/pcmcia/vx/vxp_mixer.c +++ b/sound/pcmcia/vx/vxp_mixer.c @@ -53,6 +53,10 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v { struct vx_core *_chip = snd_kcontrol_chip(kcontrol); struct snd_vxpocket *chip = (struct snd_vxpocket *)_chip; + unsigned int val = ucontrol->value.integer.value[0]; + + if (val > MIC_LEVEL_MAX) + return -EINVAL; mutex_lock(&_chip->mixer_mutex); if (chip->mic_level != ucontrol->value.integer.value[0]) { vx_set_mic_level(_chip, ucontrol->value.integer.value[0]); @@ -94,10 +98,11 @@ static int vx_mic_boost_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v { struct vx_core *_chip = snd_kcontrol_chip(kcontrol); struct snd_vxpocket *chip = (struct snd_vxpocket *)_chip; + int val = !!ucontrol->value.integer.value[0]; mutex_lock(&_chip->mixer_mutex); - if (chip->mic_level != ucontrol->value.integer.value[0]) { - vx_set_mic_boost(_chip, ucontrol->value.integer.value[0]); - chip->mic_level = ucontrol->value.integer.value[0]; + if (chip->mic_level != val) { + vx_set_mic_boost(_chip, val); + chip->mic_level = val; mutex_unlock(&_chip->mixer_mutex); return 1; } -- cgit v1.1