ALSA: compress - move the buffer check
authorVinod Koul <vinod.koul@linux.intel.com>
Mon, 17 Sep 2012 06:21:25 +0000 (11:51 +0530)
committerTakashi Iwai <tiwai@suse.de>
Mon, 17 Sep 2012 07:54:41 +0000 (09:54 +0200)
Commit ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()
added a new error check for input params.
this add new routine for input checks and moves buffer overflow check to this
new routine. This allows the error value to be propogated to user space

Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/compress_offload.c

index 68fe02c7400a29c8b4584b45a44ed75205950b2b..bd7f28e8925404d03b9e9f83d16f20aa09269e8b 100644 (file)
@@ -407,10 +407,6 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
        unsigned int buffer_size;
        void *buffer;
 
-       if (params->buffer.fragment_size == 0 ||
-           params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
-               return -EINVAL;
-
        buffer_size = params->buffer.fragment_size * params->buffer.fragments;
        if (stream->ops->copy) {
                buffer = NULL;
@@ -429,6 +425,16 @@ static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
        return 0;
 }
 
+static int snd_compress_check_input(struct snd_compr_params *params)
+{
+       /* first let's check the buffer parameter's */
+       if (params->buffer.fragment_size == 0 ||
+                       params->buffer.fragments > SIZE_MAX / params->buffer.fragment_size)
+               return -EINVAL;
+
+       return 0;
+}
+
 static int
 snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
 {
@@ -447,11 +453,17 @@ snd_compr_set_params(struct snd_compr_stream *stream, unsigned long arg)
                        retval = -EFAULT;
                        goto out;
                }
+
+               retval = snd_compress_check_input(params);
+               if (retval)
+                       goto out;
+
                retval = snd_compr_allocate_buffer(stream, params);
                if (retval) {
                        retval = -ENOMEM;
                        goto out;
                }
+
                retval = stream->ops->set_params(stream, params);
                if (retval)
                        goto out;