diff options
author | 2015-03-05 20:49:06 +0300 | |
---|---|---|
committer | 2015-03-06 13:04:42 +0100 | |
commit | d124380674b58f62d0ef974630d74d67bb8afeb0 (patch) | |
tree | 62b34be40785bf00659a881f1ef2cb01daaa376a /sound | |
parent | ALSA: line6: Clamp values correctly (diff) | |
download | linux-d124380674b58f62d0ef974630d74d67bb8afeb0.tar.gz linux-d124380674b58f62d0ef974630d74d67bb8afeb0.tar.bz2 linux-d124380674b58f62d0ef974630d74d67bb8afeb0.zip |
ALSA: opl3: small array underflow
There is a missing lower bound check on "pitchbend" so it means we can
read up to 6 elements before the start of the opl3_note_table[] array.
Thanks to Clemens Ladisch for his help with this patch.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r-- | sound/drivers/opl3/opl3_midi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c index f62780ed64ad..7821b07415a7 100644 --- a/sound/drivers/opl3/opl3_midi.c +++ b/sound/drivers/opl3/opl3_midi.c @@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum, int pitchbend = chan->midi_pitchbend; int segment; + if (pitchbend < -0x2000) + pitchbend = -0x2000; if (pitchbend > 0x1FFF) pitchbend = 0x1FFF; |