diff mbox

ALSA: hwdep: prevent a harmless shift wrapping bug

Message ID 20170913230116.yspku7ov2hgqtigh@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter Sept. 13, 2017, 11:01 p.m. UTC 
The "info.index" variable represents a bit in hw->dsp_loaded which is
an unsigned int.  If it's higher than 31 we hit a shift wrapping bug.
This seems harmless, but I wanted to silence the static checker warning.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Takashi Iwai Sept. 18, 2017, 1:39 p.m. UTC | #1 
On Thu, 14 Sep 2017 01:01:16 +0200,
Dan Carpenter wrote:
> 
> The "info.index" variable represents a bit in hw->dsp_loaded which is
> an unsigned int.  If it's higher than 31 we hit a shift wrapping bug.
> This seems harmless, but I wanted to silence the static checker warning.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, applied.


Takashi
diff mbox

Patch

diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
index a73baa1242be..8faae3d1455d 100644
--- a/sound/core/hwdep.c
+++ b/sound/core/hwdep.c
@@ -228,6 +228,8 @@  static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
 	memset(&info, 0, sizeof(info));
 	if (copy_from_user(&info, _info, sizeof(info)))
 		return -EFAULT;
+	if (info.index >= 32)
+		return -EINVAL;
 	/* check whether the dsp was already loaded */
 	if (hw->dsp_loaded & (1 << info.index))
 		return -EBUSY;