diff options
| author | Philipp Stanner <pstanner@redhat.com> | 2023-11-02 20:03:10 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2023-11-20 12:38:31 +0100 |
| commit | 5a77457232fa0453da4d3d5a7d530129944aeeb5 (patch) | |
| tree | 944d29988a4098e91b38df2d926dfb19b807a068 /sound/isa | |
| parent | d04ce4113cb4e5c2deddcb161db42a25917f285f (diff) | |
ALSA: wavefront: copy userspace array safely
wavefront_fx.c utilizes memdup_user() to copy a userspace array. This
does not check for an overflow.
Use the new wrapper memdup_array_user() to copy the array more safely.
Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
Link: https://lore.kernel.org/r/20231102190309.50891-2-pstanner@redhat.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/isa')
| -rw-r--r-- | sound/isa/wavefront/wavefront_fx.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sound/isa/wavefront/wavefront_fx.c b/sound/isa/wavefront/wavefront_fx.c index 3c21324b2a0e..0273b7dfaf12 100644 --- a/sound/isa/wavefront/wavefront_fx.c +++ b/sound/isa/wavefront/wavefront_fx.c @@ -191,9 +191,9 @@ snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file, "> 512 bytes to FX\n"); return -EIO; } - page_data = memdup_user((unsigned char __user *) - r.data[3], - r.data[2] * sizeof(short)); + page_data = memdup_array_user((unsigned char __user *) + r.data[3], + r.data[2], sizeof(short)); if (IS_ERR(page_data)) return PTR_ERR(page_data); pd = page_data; |