Commit a7a13d06 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai

ALSA: rawmidi: fix the get next midi device ioctl

If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then
the "next device" should be -1.  This function just returns device + 1.

But the main thing is that "device + 1" can lead to a (harmless) integer
overflow and that annoys static analysis tools.

[fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai]
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 27f7ad53
......@@ -829,6 +829,8 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
if (get_user(device, (int __user *)argp))
return -EFAULT;
if (device >= SNDRV_RAWMIDI_DEVICES) /* next device is -1 */
device = SNDRV_RAWMIDI_DEVICES - 1;
mutex_lock(&register_mutex);
device = device < 0 ? 0 : device + 1;
while (device < SNDRV_RAWMIDI_DEVICES) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment