ALSA: emux: stop if copy_from_user() fails
If we can't fill the "patch" struct because "count" is too small (it can be as low as 4 bytes) or because copy_from_user() failed, then just return instead of using unintialized data. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Родитель
03a1f48e53
Коммит
5885615e44
|
@ -225,9 +225,9 @@ snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format,
|
|||
else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {
|
||||
struct soundfont_patch_info patch;
|
||||
if (count < (int)sizeof(patch))
|
||||
rc = -EINVAL;
|
||||
return -EINVAL;
|
||||
if (copy_from_user(&patch, buf, sizeof(patch)))
|
||||
rc = -EFAULT;
|
||||
return -EFAULT;
|
||||
if (patch.type >= SNDRV_SFNT_LOAD_INFO &&
|
||||
patch.type <= SNDRV_SFNT_PROBE_DATA)
|
||||
rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));
|
||||
|
|
Загрузка…
Ссылка в новой задаче