aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorRohit kumar <rohitkr@codeaurora.org>2020-08-21 20:27:25 +0530
committerRohit kumar <rohitkr@codeaurora.org>2020-09-04 14:43:27 +0530
commitf4ee45366faca0e0e8a964434d7c8a7fbdbac228 (patch)
tree49e7e15ba956ea8ef45250060ca84c381b77ec94 /src
parentfd59e16f1893d8b49b0fae421d09df7161b52616 (diff)
mixer: Fix invalid size check in mixer_ctl_set/get_array
For TLV based mixer controls, mixer_ctl_set/get_array adds TLV headers in the API itself. Size check for count need not include tlv header size addition. Remove it to fix size check.
Diffstat (limited to 'src')
-rw-r--r--src/mixer.c25
1 files changed, 7 insertions, 18 deletions
diff --git a/src/mixer.c b/src/mixer.c
index 94aa019..6a104fe 100644
--- a/src/mixer.c
+++ b/src/mixer.c
@@ -936,21 +936,13 @@ int mixer_ctl_get_array(const struct mixer_ctl *ctl, void *array, size_t count)
int ret = 0;
size_t size;
void *source;
- size_t total_count;
if (!ctl || !count || !array)
return -EINVAL;
grp = ctl->grp;
- total_count = ctl->info.count;
- if ((ctl->info.type == SNDRV_CTL_ELEM_TYPE_BYTES) &&
- (mixer_ctl_is_access_tlv_rw(ctl))) {
- /* Additional two words is for the TLV header */
- total_count += TLV_HEADER_SIZE;
- }
-
- if (count > total_count)
+ if (count > ctl->info.count)
return -EINVAL;
memset(&ev, 0, sizeof(ev));
@@ -974,9 +966,11 @@ int mixer_ctl_get_array(const struct mixer_ctl *ctl, void *array, size_t count)
if (count > SIZE_MAX - sizeof(*tlv))
return -EINVAL;
+
tlv = calloc(1, sizeof(*tlv) + count);
if (!tlv)
return -ENOMEM;
+
tlv->numid = ctl->info.id.numid;
tlv->length = count;
ret = grp->ops->ioctl(grp->data, SNDRV_CTL_IOCTL_TLV_READ, tlv);
@@ -1076,21 +1070,13 @@ int mixer_ctl_set_array(struct mixer_ctl *ctl, const void *array, size_t count)
struct snd_ctl_elem_value ev;
size_t size;
void *dest;
- size_t total_count;
if ((!ctl) || !count || !array)
return -EINVAL;
grp = ctl->grp;
- total_count = ctl->info.count;
- if ((ctl->info.type == SNDRV_CTL_ELEM_TYPE_BYTES) &&
- (mixer_ctl_is_access_tlv_rw(ctl))) {
- /* Additional TLV header */
- total_count += TLV_HEADER_SIZE;
- }
-
- if (count > total_count)
+ if (count > ctl->info.count)
return -EINVAL;
memset(&ev, 0, sizeof(ev));
@@ -1108,11 +1094,14 @@ int mixer_ctl_set_array(struct mixer_ctl *ctl, const void *array, size_t count)
if (mixer_ctl_is_access_tlv_rw(ctl)) {
struct snd_ctl_tlv *tlv;
int ret = 0;
+
if (count > SIZE_MAX - sizeof(*tlv))
return -EINVAL;
+
tlv = calloc(1, sizeof(*tlv) + count);
if (!tlv)
return -ENOMEM;
+
tlv->numid = ctl->info.id.numid;
tlv->length = count;
memcpy(tlv->tlv, array, count);