]>
Commit | Line | Data |
---|---|---|
a9593ee3 SL |
1 | From 46df7aa08cd2c627933e0943a7982bcd97953745 Mon Sep 17 00:00:00 2001 |
2 | From: Dan Carpenter <dan.carpenter@oracle.com> | |
3 | Date: Fri, 21 Dec 2018 12:06:58 +0300 | |
4 | Subject: ALSA: compress: prevent potential divide by zero bugs | |
5 | ||
6 | [ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ] | |
7 | ||
8 | The problem is seen in the q6asm_dai_compr_set_params() function: | |
9 | ||
10 | ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys, | |
11 | (prtd->pcm_size / prtd->periods), | |
12 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | |
13 | prtd->periods); | |
14 | ||
15 | In this code prtd->pcm_size is the buffer_size and prtd->periods comes | |
16 | from params->buffer.fragments. If we allow the number of fragments to | |
17 | be zero then it results in a divide by zero bug. One possible fix would | |
18 | be to use prtd->pcm_count directly instead of using the division to | |
19 | re-calculate it. But I decided that it doesn't really make sense to | |
20 | allow zero fragments. | |
21 | ||
22 | Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> | |
23 | Signed-off-by: Mark Brown <broonie@kernel.org> | |
24 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
25 | --- | |
26 | sound/core/compress_offload.c | 3 ++- | |
27 | 1 file changed, 2 insertions(+), 1 deletion(-) | |
28 | ||
29 | diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c | |
30 | index 4490a699030b1..555df64d46ffc 100644 | |
31 | --- a/sound/core/compress_offload.c | |
32 | +++ b/sound/core/compress_offload.c | |
33 | @@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) | |
34 | { | |
35 | /* first let's check the buffer parameter's */ | |
36 | if (params->buffer.fragment_size == 0 || | |
37 | - params->buffer.fragments > INT_MAX / params->buffer.fragment_size) | |
38 | + params->buffer.fragments > INT_MAX / params->buffer.fragment_size || | |
39 | + params->buffer.fragments == 0) | |
40 | return -EINVAL; | |
41 | ||
42 | /* now codec parameters */ | |
43 | -- | |
44 | 2.19.1 | |
45 |