diff options
| author | Artem Egorkine <arteme@gmail.com> | 2022-12-25 12:57:28 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2022-12-26 09:07:49 +0100 |
| commit | b8800d324abb50160560c636bfafe2c81001b66c (patch) | |
| tree | abdae8fe3de8e7c366d556a627f8f036c9b801e8 /sound | |
| parent | 8508fa2e7472f673edbeedf1b1d2b7a6bb898ecc (diff) | |
ALSA: line6: fix stack overflow in line6_midi_transmit
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are sent to a PODxt device.
Signed-off-by: Artem Egorkine <arteme@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20221225105728.1153989-2-arteme@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/usb/line6/midi.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c index d52355de2bbc..0838632c788e 100644 --- a/sound/usb/line6/midi.c +++ b/sound/usb/line6/midi.c @@ -44,7 +44,8 @@ static void line6_midi_transmit(struct snd_rawmidi_substream *substream) int req, done; for (;;) { - req = min(line6_midibuf_bytes_free(mb), line6->max_packet_size); + req = min3(line6_midibuf_bytes_free(mb), line6->max_packet_size, + LINE6_FALLBACK_MAXPACKETSIZE); done = snd_rawmidi_transmit_peek(substream, chunk, req); if (done == 0) |