Unverified Commit 14cca086 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10475 ALSA: emux: improve patch ioctl data validation 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zheng Yejian <zhengyejian1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/64UI2GBRYXH2QCAIDTSPUFMUCNOPVR4E/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAGEP7 
 
Link:https://gitee.com/openeuler/kernel/pulls/10475

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 4a618915 f4d2eb4f

sound/synth/emux/soundfont.c

+11 −6
Original line number Diff line number Diff line
@@ -697,7 +697,6 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) 
	struct snd_soundfont *sf;

	struct soundfont_sample_info sample_info;

	struct snd_sf_sample *sp;

	long off;



	/* patch must be opened */

	if ((sf = sflist->currsf) == NULL)
@@ -706,12 +705,16 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) 
	if (is_special_type(sf->type))

		return -EINVAL;



	if (count < (long)sizeof(sample_info)) {

		return -EINVAL;

	}

	if (copy_from_user(&sample_info, data, sizeof(sample_info)))

		return -EFAULT;

	data += sizeof(sample_info);

	count -= sizeof(sample_info);



	off = sizeof(sample_info);



	if (sample_info.size != (count-off)/2)

	// SoundFont uses S16LE samples.

	if (sample_info.size * 2 != count)

		return -EINVAL;



	/* Check for dup */
@@ -738,7 +741,7 @@ load_data(struct snd_sf_list *sflist, const void __user *data, long count) 
		int  rc;

		rc = sflist->callback.sample_new

			(sflist->callback.private_data, sp, sflist->memhdr,

			 data + off, count - off);

			 data, count);

		if (rc < 0) {

			sf_sample_delete(sflist, sf, sp);

			return rc;
@@ -951,10 +954,12 @@ load_guspatch(struct snd_sf_list *sflist, const char __user *data, 
	}

	if (copy_from_user(&patch, data, sizeof(patch)))

		return -EFAULT;

	

	count -= sizeof(patch);

	data += sizeof(patch);



	if ((patch.len << (patch.mode & WAVE_16_BITS ? 1 : 0)) != count)

		return -EINVAL;



	sf = newsf(sflist, SNDRV_SFNT_PAT_TYPE_GUS|SNDRV_SFNT_PAT_SHARED, NULL);

	if (sf == NULL)

		return -ENOMEM;