Skip to content

Commit 883a1d4

Browse files
larsclausentiwai
authored andcommitted
ALSA: control: Make sure that id->index does not overflow
The ALSA control code expects that the range of assigned indices to a control is continuous and does not overflow. Currently there are no checks to enforce this. If a control with a overflowing index range is created that control becomes effectively inaccessible and unremovable since snd_ctl_find_id() will not be able to find it. This patch adds a check that makes sure that controls with a overflowing index range can not be created. Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Acked-by: Jaroslav Kysela <perex@perex.cz> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent ac902c1 commit 883a1d4

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

Diff for: sound/core/control.c

+3
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
342342
if (snd_BUG_ON(!card || !kcontrol->info))
343343
goto error;
344344
id = kcontrol->id;
345+
if (id.index > UINT_MAX - kcontrol->count)
346+
goto error;
347+
345348
down_write(&card->controls_rwsem);
346349
if (snd_ctl_find_id(card, &id)) {
347350
up_write(&card->controls_rwsem);

0 commit comments

Comments
 (0)