| Message ID | 20150303191318.GA7569@mwanda (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Dan Carpenter wrote: > We don't check for negatives so "pitchbend" can be SHRT_MIN here. It > means that we can read up to 6 elements before the start of the > opl3_note_table[] array. > > There are several ways we could fix this. I have gone with what is > maybe the lazier approach of just changing negative values to zero. The lower bound is not zero but -8192. Regards, Clemens
On Tue, Mar 03, 2015 at 09:59:17PM +0100, Clemens Ladisch wrote: > Dan Carpenter wrote: > > We don't check for negatives so "pitchbend" can be SHRT_MIN here. It > > means that we can read up to 6 elements before the start of the > > opl3_note_table[] array. > > > > There are several ways we could fix this. I have gone with what is > > maybe the lazier approach of just changing negative values to zero. > > The lower bound is not zero but -8192. Oh. I should have understood that from your previous email. Sorry for that. Third time is lucky, I suppose. regards, dan carpenter
diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c index f62780e..0cb91dc 100644 --- a/sound/drivers/opl3/opl3_midi.c +++ b/sound/drivers/opl3/opl3_midi.c @@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum, int pitchbend = chan->midi_pitchbend; int segment; + if (pitchbend < 0) + pitchbend = 0; if (pitchbend > 0x1FFF) pitchbend = 0x1FFF;
We don't check for negatives so "pitchbend" can be SHRT_MIN here. It means that we can read up to 6 elements before the start of the opl3_note_table[] array. There are several ways we could fix this. I have gone with what is maybe the lazier approach of just changing negative values to zero. Hopefully, people aren't passing negatives here anyway. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: The first patch just chan->midi_pitchbend unsigned but Clemens Ladisch pointed out that that breaks the API.