sound/oss: remove offset from load_patch callbacks
authorDan Rosenberg <drosenberg@vsecurity.com>
Wed, 23 Mar 2011 14:53:41 +0000 (10:53 -0400)
committerTakashi Iwai <tiwai@suse.de>
Wed, 23 Mar 2011 21:47:46 +0000 (22:47 +0100)
commitb769f49463711205d57286e64cf535ed4daf59e9
tree1c674fdbed533434d2ba9b7b1b3646243160e55c
parentce24f58a1187ca3058d72c3f897e3b574209ab20
sound/oss: remove offset from load_patch callbacks

Was: [PATCH] sound/oss/midi_synth: prevent underflow, use of
uninitialized value, and signedness issue

The offset passed to midi_synth_load_patch() can be essentially
arbitrary.  If it's greater than the header length, this will result in
a copy_from_user(dst, src, negative_val).  While this will just return
-EFAULT on x86, on other architectures this may cause memory corruption.
Additionally, the length field of the sysex_info structure may not be
initialized prior to its use.  Finally, a signed comparison may result
in an unintentionally large loop.

On suggestion by Takashi Iwai, version two removes the offset argument
from the load_patch callbacks entirely, which also resolves similar
issues in opl3.  Compile tested only.

v3 adjusts comments and hopefully gets copy offsets right.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/oss/dev_table.h
sound/oss/midi_synth.c
sound/oss/midi_synth.h
sound/oss/opl3.c
sound/oss/sequencer.c