diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-08-18 18:55:15 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2012-08-20 10:24:21 +0200 |
| commit | 94f3ec6b2222eb5c0af0c784f0656ff5b909d870 (patch) | |
| tree | d67fe0f941e81a1c47d9b49de144f62aeda5c4ee | |
| parent | 5e68fb3cab23b327e9f15803607e697d7eea1966 (diff) | |
| download | linux-rpi3-94f3ec6b2222eb5c0af0c784f0656ff5b909d870.tar.gz linux-rpi3-94f3ec6b2222eb5c0af0c784f0656ff5b909d870.tar.bz2 linux-rpi3-94f3ec6b2222eb5c0af0c784f0656ff5b909d870.zip | |
sound: oss/sb_audio: prevent divide by zero bug
Speed comes from get_user() in audio_ioctl(). We use it to set the "s"
variable before clamping it to valid values so it could lead to a divide
by zero bug.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/oss/sb_audio.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c index 733b014ec7d1..b2b3c014221a 100644 --- a/sound/oss/sb_audio.c +++ b/sound/oss/sb_audio.c @@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed) if (speed > 0) { int tmp; - int s = speed * devc->channels; + int s; if (speed < 5000) speed = 5000; if (speed > 44100) speed = 44100; + s = speed * devc->channels; + devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff; tmp = 256 - devc->tconst; |