summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-03-31 16:53:40 +0300
committerTakashi Iwai <tiwai@suse.de>2017-03-31 16:23:52 +0200
commit5885615e44faebaf379fa0cdd2b9c084960dae38 (patch)
tree266ff2dba40f9b0b5a79f0687df9c3d23d3ee6a7
parent03a1f48e5371a252b3b8c16a7cbea3c0bd8689bb (diff)
ALSA: emux: stop if copy_from_user() fails
If we can't fill the "patch" struct because "count" is too small (it can be as low as 4 bytes) or because copy_from_user() failed, then just return instead of using unintialized data. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/synth/emux/emux_oss.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
index ac75816ada7c..850fab4a8f3b 100644
--- a/sound/synth/emux/emux_oss.c
+++ b/sound/synth/emux/emux_oss.c
@@ -225,9 +225,9 @@ snd_emux_load_patch_seq_oss(struct snd_seq_oss_arg *arg, int format,
else if (format == SNDRV_OSS_SOUNDFONT_PATCH) {
struct soundfont_patch_info patch;
if (count < (int)sizeof(patch))
- rc = -EINVAL;
+ return -EINVAL;
if (copy_from_user(&patch, buf, sizeof(patch)))
- rc = -EFAULT;
+ return -EFAULT;
if (patch.type >= SNDRV_SFNT_LOAD_INFO &&
patch.type <= SNDRV_SFNT_PROBE_DATA)
rc = snd_soundfont_load(emu->sflist, buf, count, SF_CLIENT_NO(p->chset.port));