85c50a5899
The "dev" variable could be out of bounds. Calling
snd_seq_oss_synth_is_valid() checks that it is is a valid device
which has been opened. We check this inside set_note_event() so
this function can't succeed without a valid "dev". But we need to
do the check earlier to prevent invalid dereferences and memory
corruption.
One call tree where "dev" could be out of bounds is:
-> snd_seq_oss_oob_user()
-> snd_seq_oss_process_event()
-> extended_event()
-> note_on_event()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| seq_oss_device.h | ||
| seq_oss_event.c | ||
| seq_oss_event.h | ||
| seq_oss_init.c | ||
| seq_oss_ioctl.c | ||
| seq_oss_midi.c | ||
| seq_oss_midi.h | ||
| seq_oss_readq.c | ||
| seq_oss_readq.h | ||
| seq_oss_rw.c | ||
| seq_oss_synth.c | ||
| seq_oss_synth.h | ||
| seq_oss_timer.c | ||
| seq_oss_timer.h | ||
| seq_oss_writeq.c | ||
| seq_oss_writeq.h | ||
| seq_oss.c | ||