From patchwork Tue Mar 3 09:38:29 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 5920881 Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 96F5FBF440 for ; Tue, 3 Mar 2015 09:39:41 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D413120123 for ; Tue, 3 Mar 2015 09:39:40 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id 28CF820160 for ; Tue, 3 Mar 2015 09:39:39 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id 41EA32608BC; Tue, 3 Mar 2015 10:39:38 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_DNS_FOR_FROM, UNPARSEABLE_RELAY autolearn=no version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id 618682608ED; Tue, 3 Mar 2015 10:39:20 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 3880C260A50; Tue, 3 Mar 2015 10:39:18 +0100 (CET) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by alsa0.perex.cz (Postfix) with ESMTP id ED36D2608ED for ; Tue, 3 Mar 2015 10:38:47 +0100 (CET) Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id t239chZH009167 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 3 Mar 2015 09:38:45 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by aserv0022.oracle.com (8.13.8/8.13.8) with ESMTP id t239cgVV016211 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 3 Mar 2015 09:38:43 GMT Received: from abhmp0007.oracle.com (abhmp0007.oracle.com [141.146.116.13]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id t239cg8J009431; Tue, 3 Mar 2015 09:38:42 GMT Received: from mwanda (/154.0.139.178) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 03 Mar 2015 01:38:42 -0800 Date: Tue, 3 Mar 2015 12:38:29 +0300 From: Dan Carpenter To: Jaroslav Kysela Message-ID: <20150303093829.GA7685@mwanda> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Cc: Takashi Iwai , alsa-devel@alsa-project.org, kernel-janitors@vger.kernel.org Subject: [alsa-devel] [patch] ALSA: seq_midi_emul: small array underflow X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP In snd_opl3_calc_pitch() then the limit is: if (pitchbend > 0x1FFF) pitchbend = 0x1FFF; But it can underflow meaning that segment can be as low as SHORT_MIN / 0x1000 and we can read 6 elements before the start of the opl3_note_table[] array. Signed-off-by: Dan Carpenter diff --git a/include/sound/seq_midi_emul.h b/include/sound/seq_midi_emul.h index 8139d8c..c02b840 100644 --- a/include/sound/seq_midi_emul.h +++ b/include/sound/seq_midi_emul.h @@ -44,7 +44,7 @@ struct snd_midi_channel { unsigned char midi_aftertouch; /* Aftertouch (key pressure) */ unsigned char midi_pressure; /* Channel pressure */ unsigned char midi_program; /* Instrument number */ - short midi_pitchbend; /* Pitch bend amount */ + unsigned short midi_pitchbend; /* Pitch bend amount */ unsigned char control[128]; /* Current value of all controls */ unsigned char note[128]; /* Current status for all notes */