| Message ID | 20200521172931.121903-1-brogers@suse.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | audio: fix wavcapture segfault | expand |
On 5/21/20 7:29 PM, Bruce Rogers wrote: > Commit 571a8c522e caused the HMP wavcapture command to segfault when > processing audio data in audio_pcm_sw_write(), where a NULL > sw->hw->pcm_ops is dereferenced. This fix checks that the pointer is > valid before dereferincing it. A similar fix is also made in the > parallel function audio_pcm_sw_read(). > > Fixes: 571a8c522e (audio: split ctl_* functions into enable_* and > volume_*) > Signed-off-by: Bruce Rogers <brogers@suse.com> > --- > audio/audio.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/audio/audio.c b/audio/audio.c > index 7a9e680355..08a067722b 100644 > --- a/audio/audio.c > +++ b/audio/audio.c > @@ -649,7 +649,7 @@ static size_t audio_pcm_sw_read(SWVoiceIn *sw, void *buf, size_t size) > total += isamp; > } > > - if (!hw->pcm_ops->volume_in) { > + if (hw->pcm_ops && !hw->pcm_ops->volume_in) { > mixeng_volume (sw->buf, ret, &sw->vol); > } > > @@ -736,7 +736,7 @@ static size_t audio_pcm_sw_write(SWVoiceOut *sw, void *buf, size_t size) > if (swlim) { > sw->conv (sw->buf, buf, swlim); > > - if (!sw->hw->pcm_ops->volume_out) { > + if (sw->hw->pcm_ops && !sw->hw->pcm_ops->volume_out) { > mixeng_volume (sw->buf, swlim, &sw->vol); > } > } > Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
On Thu, May 21, 2020 at 11:29:31AM -0600, Bruce Rogers wrote: > Commit 571a8c522e caused the HMP wavcapture command to segfault when > processing audio data in audio_pcm_sw_write(), where a NULL > sw->hw->pcm_ops is dereferenced. This fix checks that the pointer is > valid before dereferincing it. A similar fix is also made in the > parallel function audio_pcm_sw_read(). > > Fixes: 571a8c522e (audio: split ctl_* functions into enable_* and > volume_*) > Signed-off-by: Bruce Rogers <brogers@suse.com> Added to audio queue. thanks, Gerd
diff --git a/audio/audio.c b/audio/audio.c index 7a9e680355..08a067722b 100644 --- a/audio/audio.c +++ b/audio/audio.c @@ -649,7 +649,7 @@ static size_t audio_pcm_sw_read(SWVoiceIn *sw, void *buf, size_t size) total += isamp; } - if (!hw->pcm_ops->volume_in) { + if (hw->pcm_ops && !hw->pcm_ops->volume_in) { mixeng_volume (sw->buf, ret, &sw->vol); } @@ -736,7 +736,7 @@ static size_t audio_pcm_sw_write(SWVoiceOut *sw, void *buf, size_t size) if (swlim) { sw->conv (sw->buf, buf, swlim); - if (!sw->hw->pcm_ops->volume_out) { + if (sw->hw->pcm_ops && !sw->hw->pcm_ops->volume_out) { mixeng_volume (sw->buf, swlim, &sw->vol); } }
Commit 571a8c522e caused the HMP wavcapture command to segfault when processing audio data in audio_pcm_sw_write(), where a NULL sw->hw->pcm_ops is dereferenced. This fix checks that the pointer is valid before dereferincing it. A similar fix is also made in the parallel function audio_pcm_sw_read(). Fixes: 571a8c522e (audio: split ctl_* functions into enable_* and volume_*) Signed-off-by: Bruce Rogers <brogers@suse.com> --- audio/audio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)