| Message ID | 20150303093829.GA7685@mwanda (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Dan Carpenter wrote: > In snd_opl3_calc_pitch() then the limit is: > > if (pitchbend > 0x1FFF) > pitchbend = 0x1FFF; > > But it can underflow meaning that segment can be as low as > SHORT_MIN / 0x1000 and we can read 6 elements before the start of the > opl3_note_table[] array. > - short midi_pitchbend; /* Pitch bend amount */ > + unsigned short midi_pitchbend; /* Pitch bend amount */ Pitch bend is a signed 14-bit value. What is wrong is the missing check for the lower bound. Regards, Clemens
On Tue, Mar 03, 2015 at 12:21:34PM +0100, Clemens Ladisch wrote: > Dan Carpenter wrote: > > In snd_opl3_calc_pitch() then the limit is: > > > > if (pitchbend > 0x1FFF) > > pitchbend = 0x1FFF; > > > > But it can underflow meaning that segment can be as low as > > SHORT_MIN / 0x1000 and we can read 6 elements before the start of the > > opl3_note_table[] array. > > > - short midi_pitchbend; /* Pitch bend amount */ > > + unsigned short midi_pitchbend; /* Pitch bend amount */ > > Pitch bend is a signed 14-bit value. What is wrong is the missing > check for the lower bound. > Thanks for the review. I will resend. regards, dan carpenter
diff --git a/include/sound/seq_midi_emul.h b/include/sound/seq_midi_emul.h index 8139d8c..c02b840 100644 --- a/include/sound/seq_midi_emul.h +++ b/include/sound/seq_midi_emul.h @@ -44,7 +44,7 @@ struct snd_midi_channel { unsigned char midi_aftertouch; /* Aftertouch (key pressure) */ unsigned char midi_pressure; /* Channel pressure */ unsigned char midi_program; /* Instrument number */ - short midi_pitchbend; /* Pitch bend amount */ + unsigned short midi_pitchbend; /* Pitch bend amount */ unsigned char control[128]; /* Current value of all controls */ unsigned char note[128]; /* Current status for all notes */
In snd_opl3_calc_pitch() then the limit is: if (pitchbend > 0x1FFF) pitchbend = 0x1FFF; But it can underflow meaning that segment can be as low as SHORT_MIN / 0x1000 and we can read 6 elements before the start of the opl3_note_table[] array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>