aboutsummaryrefslogtreecommitdiffstats
path: root/sound
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-09-09 00:11:41 +0200
committerTakashi Iwai <tiwai@suse.de>2010-09-09 09:05:21 +0200
commita7a13d0676335a7dc9dd72264cca02606e43aaba (patch)
tree5c9a4c47f735174d13d3ab6d64c8c191d70d0968 /sound
parent27f7ad53829f79e799a253285318bff79ece15bd (diff)
downloadmrst-s0i3-test-a7a13d0676335a7dc9dd72264cca02606e43aaba.tar.gz
mrst-s0i3-test-a7a13d0676335a7dc9dd72264cca02606e43aaba.tar.xz
mrst-s0i3-test-a7a13d0676335a7dc9dd72264cca02606e43aaba.zip
ALSA: rawmidi: fix the get next midi device ioctl
If we pass in a device which is higher than SNDRV_RAWMIDI_DEVICES then the "next device" should be -1. This function just returns device + 1. But the main thing is that "device + 1" can lead to a (harmless) integer overflow and that annoys static analysis tools. [fix the case for device == SNDRV_RAWMIDI_DEVICE by tiwai] Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r--sound/core/rawmidi.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index eb68326c37d..a7868ad4d53 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -829,6 +829,8 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
if (get_user(device, (int __user *)argp))
return -EFAULT;
+ if (device >= SNDRV_RAWMIDI_DEVICES) /* next device is -1 */
+ device = SNDRV_RAWMIDI_DEVICES - 1;
mutex_lock(&register_mutex);
device = device < 0 ? 0 : device + 1;
while (device < SNDRV_RAWMIDI_DEVICES) {