summaryrefslogtreecommitdiff
path: root/sound/drivers
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2007-11-15 16:17:24 +0100
committerJaroslav Kysela <perex@perex.cz>2008-01-31 17:29:25 +0100
commit3b892467786410f26dffc2c7bccd3ea445604037 (patch)
tree4a70f86b1545e9be95d987fc248cac3cebbbd9a8 /sound/drivers
parent498ade1a133dffd0f3ee90952737045d56e6689a (diff)
[ALSA] Check value range in ctl callbacks
Check the value ranges in ctl put callbacks properly (in the rest drivers). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound/drivers')
-rw-r--r--sound/drivers/mts64.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
index dcc90f995294..68070cccc6be 100644
--- a/sound/drivers/mts64.c
+++ b/sound/drivers/mts64.c
@@ -461,13 +461,14 @@ static int snd_mts64_ctl_smpte_switch_put(struct snd_kcontrol* kctl,
{
struct mts64 *mts = snd_kcontrol_chip(kctl);
int changed = 0;
+ int val = !!uctl->value.integer.value[0];
spin_lock_irq(&mts->lock);
- if (mts->smpte_switch == uctl->value.integer.value[0])
+ if (mts->smpte_switch == val)
goto __out;
changed = 1;
- mts->smpte_switch = uctl->value.integer.value[0];
+ mts->smpte_switch = val;
if (mts->smpte_switch) {
mts64_smpte_start(mts->pardev->port,
mts->time[0], mts->time[1],
@@ -541,12 +542,13 @@ static int snd_mts64_ctl_smpte_time_put(struct snd_kcontrol *kctl,
{
struct mts64 *mts = snd_kcontrol_chip(kctl);
int idx = kctl->private_value;
+ unsigned int time = uctl->value.integer.value[0] % 60;
int changed = 0;
spin_lock_irq(&mts->lock);
- if (mts->time[idx] != uctl->value.integer.value[0]) {
+ if (mts->time[idx] != time) {
changed = 1;
- mts->time[idx] = uctl->value.integer.value[0];
+ mts->time[idx] = time;
}
spin_unlock_irq(&mts->lock);
@@ -636,6 +638,8 @@ static int snd_mts64_ctl_smpte_fps_put(struct snd_kcontrol *kctl,
struct mts64 *mts = snd_kcontrol_chip(kctl);
int changed = 0;
+ if (uctl->value.enumerated.item[0] >= 5)
+ return -EINVAL;
spin_lock_irq(&mts->lock);
if (mts->fps != uctl->value.enumerated.item[0]) {
changed = 1;