diff options
| author | Artem Egorkine | 2022-12-25 12:57:28 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2023-01-04 11:29:00 +0100 |
| commit | 389d34c2a8b52acc351fd932ed4bea41fee5a39b (patch) | |
| tree | 9cf5531a39b90634956d669bffc680311caaeff3 /sound/usb | |
| parent | e58d1d2eb31bcdcd65981d220a23965d29bb53e6 (diff) | |
ALSA: line6: fix stack overflow in line6_midi_transmit
commit b8800d324abb50160560c636bfafe2c81001b66c upstream.
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are sent to a PODxt device.
Signed-off-by: Artem Egorkine <arteme@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20221225105728.1153989-2-arteme@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound/usb')
| -rw-r--r-- | sound/usb/line6/midi.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c index d52355de2bbc..0838632c788e 100644 --- a/sound/usb/line6/midi.c +++ b/sound/usb/line6/midi.c @@ -44,7 +44,8 @@ static void line6_midi_transmit(struct snd_rawmidi_substream *substream) int req, done; for (;;) { - req = min(line6_midibuf_bytes_free(mb), line6->max_packet_size); + req = min3(line6_midibuf_bytes_free(mb), line6->max_packet_size, + LINE6_FALLBACK_MAXPACKETSIZE); done = snd_rawmidi_transmit_peek(substream, chunk, req); if (done == 0) |