• Dan Rosenberg's avatar
    sound/oss: remove offset from load_patch callbacks · b769f494
    Dan Rosenberg authored
    Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of
    uninitialized value, and signedness issue
    
    The offset passed to midi_synth_load_patch() can be essentially
    arbitrary.  If it's greater than the header length, this will result in
    a copy_from_user(dst, src, negative_val).  While this will just return
    -EFAULT on x86, on other architectures this may cause memory corruption.
    Additionally, the length field of the sysex_info structure may not be
    initialized prior to its use.  Finally, a signed comparison may result
    in an unintentionally large loop.
    
    On suggestion by Takashi Iwai, version two removes the offset argument
    from the load_patch callbacks entirely, which also resolves similar
    issues in opl3.  Compile tested only.
    
    v3 adjusts comments and hopefully gets copy offsets right.
    Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    b769f494
midi_synth.c 14.8 KB