diff mbox

ALSA: emux: stop if copy_from_user() fails

Message ID 20170331135340.GA22338@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter March 31, 2017, 1:53 p.m. UTC 
If we can't fill the "patch" struct because "count" is too small (it can
be as low as 4 bytes) or because copy_from_user() failed, then just
return instead of using unintialized data.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Takashi Iwai March 31, 2017, 2:24 p.m. UTC | #1 
On Fri, 31 Mar 2017 15:53:40 +0200,
Dan Carpenter wrote:
> 
> If we can't fill the "patch" struct because "count" is too small (it can
> be as low as 4 bytes) or because copy_from_user() failed, then just
> return instead of using unintialized data.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, applied now.


Takashi
diff mbox

Patch

diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
index ac75816ada7c..850fab4a8f3b 100644
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -225,9 +225,9 @@  snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format,
 	else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {
 		struct soundfont_patch_info patch;
 		if (count < (int)sizeof(patch))
-			rc = -EINVAL;
+			return -EINVAL;
 		if (copy_from_user(&patch, buf, sizeof(patch)))
-			rc = -EFAULT;
+			return -EFAULT;
 		if (patch.type >= SNDRV_SFNT_LOAD_INFO &&
 		    patch.type <= SNDRV_SFNT_PROBE_DATA)
 			rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));