From: Dan Carpenter Date: Wed, 8 Sep 2010 22:11:41 +0000 (+0200) Subject: ALSA: rawmidi: fix the get next midi device ioctl X-Git-Tag: upstream/snapshot3+hdmi~13028^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a7a13d0676335a7dc9dd72264cca02606e43aaba;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git ALSA: rawmidi: fix the get next midi device ioctl If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then the "next device" should be -1. This function just returns device + 1. But the main thing is that "device + 1" can lead to a (harmless) integer overflow and that annoys static analysis tools. [fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai] Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai --- diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index eb68326..a7868ad 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -829,6 +829,8 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card, if (get_user(device, (int __user *)argp)) return -EFAULT; + if (device >= SNDRV_RAWMIDI_DEVICES) /* next device is -1 */ + device = SNDRV_RAWMIDI_DEVICES - 1; mutex_lock(®ister_mutex); device = device < 0 ? 0 : device + 1; while (device < SNDRV_RAWMIDI_DEVICES) {