diff options
| author | Rohit kumar <rohitkr@codeaurora.org> | 2020-08-21 20:27:25 +0530 |
|---|---|---|
| committer | Rohit kumar <rohitkr@codeaurora.org> | 2020-09-04 14:43:27 +0530 |
| commit | f4ee45366faca0e0e8a964434d7c8a7fbdbac228 (patch) | |
| tree | 49e7e15ba956ea8ef45250060ca84c381b77ec94 | |
| parent | fd59e16f1893d8b49b0fae421d09df7161b52616 (diff) | |
mixer: Fix invalid size check in mixer_ctl_set/get_array
For TLV based mixer controls, mixer_ctl_set/get_array
adds TLV headers in the API itself. Size check for count
need not include tlv header size addition. Remove it to
fix size check.
| -rw-r--r-- | src/mixer.c | 25 |
1 files changed, 7 insertions, 18 deletions
diff --git a/src/mixer.c b/src/mixer.c index 94aa019..6a104fe 100644 --- a/src/mixer.c +++ b/src/mixer.c @@ -936,21 +936,13 @@ int mixer_ctl_get_array(const struct mixer_ctl *ctl, void *array, size_t count) int ret = 0; size_t size; void *source; - size_t total_count; if (!ctl || !count || !array) return -EINVAL; grp = ctl->grp; - total_count = ctl->info.count; - if ((ctl->info.type == SNDRV_CTL_ELEM_TYPE_BYTES) && - (mixer_ctl_is_access_tlv_rw(ctl))) { - /* Additional two words is for the TLV header */ - total_count += TLV_HEADER_SIZE; - } - - if (count > total_count) + if (count > ctl->info.count) return -EINVAL; memset(&ev, 0, sizeof(ev)); @@ -974,9 +966,11 @@ int mixer_ctl_get_array(const struct mixer_ctl *ctl, void *array, size_t count) if (count > SIZE_MAX - sizeof(*tlv)) return -EINVAL; + tlv = calloc(1, sizeof(*tlv) + count); if (!tlv) return -ENOMEM; + tlv->numid = ctl->info.id.numid; tlv->length = count; ret = grp->ops->ioctl(grp->data, SNDRV_CTL_IOCTL_TLV_READ, tlv); @@ -1076,21 +1070,13 @@ int mixer_ctl_set_array(struct mixer_ctl *ctl, const void *array, size_t count) struct snd_ctl_elem_value ev; size_t size; void *dest; - size_t total_count; if ((!ctl) || !count || !array) return -EINVAL; grp = ctl->grp; - total_count = ctl->info.count; - if ((ctl->info.type == SNDRV_CTL_ELEM_TYPE_BYTES) && - (mixer_ctl_is_access_tlv_rw(ctl))) { - /* Additional TLV header */ - total_count += TLV_HEADER_SIZE; - } - - if (count > total_count) + if (count > ctl->info.count) return -EINVAL; memset(&ev, 0, sizeof(ev)); @@ -1108,11 +1094,14 @@ int mixer_ctl_set_array(struct mixer_ctl *ctl, const void *array, size_t count) if (mixer_ctl_is_access_tlv_rw(ctl)) { struct snd_ctl_tlv *tlv; int ret = 0; + if (count > SIZE_MAX - sizeof(*tlv)) return -EINVAL; + tlv = calloc(1, sizeof(*tlv) + count); if (!tlv) return -ENOMEM; + tlv->numid = ctl->info.id.numid; tlv->length = count; memcpy(tlv->tlv, array, count); |