summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-09-13 10:53:36 +0300
committerMark Brown <broonie@linaro.org>2013-09-13 18:35:55 +0100
commitd63733aed90b432e5cc489ddfa28e342f91b4652 (patch)
tree1496073ae8fc3393a68fe0abc51329ad42a81a1c /sound
parent5df498a27ab385294fdb7cad19c623d4da94a780 (diff)
ASoC: ab8500-codec: info leak in anc_status_control_put()
If the user passes an invalid value it leads to an info leak when we print the error message or it could oops. This is called with user supplied data from snd_ctl_elem_write(). Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mark Brown <broonie@linaro.org> Cc: stable@vger.kernel.org
Diffstat (limited to 'sound')
-rw-r--r--sound/soc/codecs/ab8500-codec.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index b8ba0adacfce..80555d7551e6 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -1225,13 +1225,18 @@ static int anc_status_control_put(struct snd_kcontrol *kcontrol,
struct ab8500_codec_drvdata *drvdata = dev_get_drvdata(codec->dev);
struct device *dev = codec->dev;
bool apply_fir, apply_iir;
- int req, status;
+ unsigned int req;
+ int status;
dev_dbg(dev, "%s: Enter.\n", __func__);
mutex_lock(&drvdata->anc_lock);
req = ucontrol->value.integer.value[0];
+ if (req >= ARRAY_SIZE(enum_anc_state)) {
+ status = -EINVAL;
+ goto cleanup;
+ }
if (req != ANC_APPLY_FIR_IIR && req != ANC_APPLY_FIR &&
req != ANC_APPLY_IIR) {
dev_err(dev, "%s: ERROR: Unsupported status to set '%s'!\n",