diff options
| author | Dan Carpenter | 2015-03-05 20:49:06 +0300 |
|---|---|---|
| committer | Takashi Iwai | 2015-03-06 13:04:42 +0100 |
| commit | d124380674b58f62d0ef974630d74d67bb8afeb0 (patch) | |
| tree | 62b34be40785bf00659a881f1ef2cb01daaa376a /sound | |
| parent | f44f07cf3910f84b15b2a78c4933d5946bf409cf (diff) | |
ALSA: opl3: small array underflow
There is a missing lower bound check on "pitchbend" so it means we can
read up to 6 elements before the start of the opl3_note_table[] array.
Thanks to Clemens Ladisch for his help with this patch.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/drivers/opl3/opl3_midi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c index f62780ed64ad..7821b07415a7 100644 --- a/sound/drivers/opl3/opl3_midi.c +++ b/sound/drivers/opl3/opl3_midi.c @@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum, int pitchbend = chan->midi_pitchbend; int segment; + if (pitchbend < -0x2000) + pitchbend = -0x2000; if (pitchbend > 0x1FFF) pitchbend = 0x1FFF; |