ALSA: wavefront: Fix integer overflow in sample size validation

[ Upstream commit 0c4a13ba88594fd4a27292853e736c6b4349823d ]

The wavefront_send_sample() function has an integer overflow issue
when validating sample size. The header->size field is u32 but gets
cast to int for comparison with dev->freemem

Fix by using unsigned comparison to avoid integer overflow.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881B47789D1B060CE8BF4C3AFC2A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
index 09b368761cc0043aebe65b3d9046163bcc86cd7c..23a02ab40b71397416f80a729c985dd73274fa5b 100644 (file)
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -944,9 +944,9 @@ wavefront_send_sample (snd_wavefront_t *dev,
        if (header->size) {
                dev->freemem = wavefront_freemem (dev);
 
-               if (dev->freemem < (int)header->size) {
+               if (dev->freemem < 0 || dev->freemem < header->size) {
                        snd_printk ("insufficient memory to "
-                                   "load %d byte sample.\n",
+                                   "load %u byte sample.\n",
                                    header->size);
                        return -ENOMEM;
                }