ALSA: seq: seq_oss_event: missing range checks
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 4 Mar 2013 12:19:18 +0000 (15:19 +0300)
committerTakashi Iwai <tiwai@suse.de>
Mon, 4 Mar 2013 15:39:50 +0000 (16:39 +0100)
commit85c50a5899b23f4f893b0898b286023157b98376
tree4b47c49fc31685ca10b7f48ed6a75b64703b7694
parent6dbe51c251a327e012439c4772097a13df43c5b8
ALSA: seq: seq_oss_event: missing range checks

The "dev" variable could be out of bounds.  Calling
snd_seq_oss_synth_is_valid() checks that it is is a valid device
which has been opened.  We check this inside set_note_event() so
this function can't succeed without a valid "dev".  But we need to
do the check earlier to prevent invalid dereferences and memory
corruption.

One call tree where "dev" could be out of bounds is:
-> snd_seq_oss_oob_user()
   -> snd_seq_oss_process_event()
      -> extended_event()
         -> note_on_event()

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/seq/oss/seq_oss_event.c