]> git.baikalelectronics.ru Git - kernel.git/commit
ALSA: firewire-lib: fix buffer-over-run when detecting packet discontinuity
authorTakashi Sakamoto <o-takashi@sakamocchi.jp>
Wed, 27 May 2015 15:02:59 +0000 (00:02 +0900)
committerTakashi Iwai <tiwai@suse.de>
Wed, 27 May 2015 15:44:42 +0000 (17:44 +0200)
commitf0123296eee22c8c2b72d46106a694fca3a418fa
tree44c8c4280852fb0cbabe9820a6f5e959abbdc4e0
parentf96e92b8a4d580d383d3adeab489e4bf69550825
ALSA: firewire-lib: fix buffer-over-run when detecting packet discontinuity

When detecting packet discontinuity, handle_in_packet() returns minus value
and this value is assigned to unsigned int variable, then the variable has
huge value. As a result, the variable causes buffer-over-run in
handle_out_packet(). This brings invalid page request and system hangup.

This commit fixes the bug to add a new argument into handle_in_packet()
and the number of handled data blocks is assignd to it. The function
return value is just used to check error.

I also considered to change the type of local variable to 'int' in
in_stream_callback(). This idea is based on type-conversion in C standard,
while it may cause future problems when adding more works. Thus, I dropped
this idea.

Fixes: e39129f08465('ALSA: firewire-lib: pass the number of data blocks in incoming packets to outgoing packets')
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/firewire/amdtp.c