From 94f3ec6b2222eb5c0af0c784f0656ff5b909d870 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sat, 18 Aug 2012 18:55:15 +0300 Subject: [PATCH] sound: oss/sb_audio: prevent divide by zero bug Speed comes from get_user() in audio_ioctl(). We use it to set the "s" variable before clamping it to valid values so it could lead to a divide by zero bug. Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai --- sound/oss/sb_audio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c index 733b014..b2b3c01 100644 --- a/sound/oss/sb_audio.c +++ b/sound/oss/sb_audio.c @@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed) if (speed > 0) { int tmp; - int s = speed * devc->channels; + int s; if (speed < 5000) speed = 5000; if (speed > 44100) speed = 44100; + s = speed * devc->channels; + devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff; tmp = 256 - devc->tconst; -- 2.7.4