Re: [PATCH] ALSA: fireface: Off by one in latter_handle_midi_msg()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 25 Jan 2019 14:41:39 +0100,
Takashi Sakamoto wrote:
> 
> On Fri, Jan 25, 2019 at 03:44:18PM +0300, Dan Carpenter wrote:
> > The > should be >= or otherwise we potentially read one element beyond
> > the end of the ff->tx_midi_substreams[] array.
> > 
> > Fixes: 73f5537fb209 ("ALSA: fireface: support tx MIDI functionality of Fireface UCX")
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> > ---
> >  sound/firewire/fireface/ff-protocol-latter.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/sound/firewire/fireface/ff-protocol-latter.c b/sound/firewire/fireface/ff-protocol-latter.c
> > index 817af4447349..438aeed9a1ab 100644
> > --- a/sound/firewire/fireface/ff-protocol-latter.c
> > +++ b/sound/firewire/fireface/ff-protocol-latter.c
> > @@ -275,7 +275,7 @@ static void latter_handle_midi_msg(struct snd_ff *ff, unsigned int offset,
> >  	struct snd_rawmidi_substream *substream;
> >  	unsigned int len;
> >  
> > -	if (index > ff->spec->midi_in_ports)
> > +	if (index >= ff->spec->midi_in_ports)
> >  		return;
> >  
> >  	switch (data & 0x0000000f) {
> > -- 
> > 2.17.1
>  
> Indeed. The value of index is picked up from quadlet data transferred by
> device. The range of value is expected to be 0x00 or 0x01, thus this patch is
> correct.
> 
> Reviewed-by: Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>

Applied now.  Thanks.


Takashi
_______________________________________________
Alsa-devel mailing list
Alsa-devel@xxxxxxxxxxxxxxxx
http://mailman.alsa-project.org/mailman/listinfo/alsa-devel



[Index of Archives]     [ALSA User]     [Linux Audio Users]     [Pulse Audio]     [Kernel Archive]     [Asterisk PBX]     [Photo Sharing]     [Linux Sound]     [Video 4 Linux]     [Gimp]     [Yosemite News]

  Powered by Linux