projects
/
cascardo
/
linux.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Merge branches 'doc', 'multitouch', 'upstream' and 'upstream-fixes' into for-linus
[cascardo/linux.git]
/
sound
/
oss
/
opl3.c
diff --git
a/sound/oss/opl3.c
b/sound/oss/opl3.c
index
938c48c
..
407cd67
100644
(file)
--- a/
sound/oss/opl3.c
+++ b/
sound/oss/opl3.c
@@
-820,7
+820,7
@@
static void opl3_hw_control(int dev, unsigned char *event)
}
static int opl3_load_patch(int dev, int format, const char __user *addr,
}
static int opl3_load_patch(int dev, int format, const char __user *addr,
- int
offs, int
count, int pmgr_flag)
+ int count, int pmgr_flag)
{
struct sbi_instrument ins;
{
struct sbi_instrument ins;
@@
-830,11
+830,7
@@
static int opl3_load_patch(int dev, int format, const char __user *addr,
return -EINVAL;
}
return -EINVAL;
}
- /*
- * What the fuck is going on here? We leave junk in the beginning
- * of ins and then check the field pretty close to that beginning?
- */
- if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs))
+ if (copy_from_user(&ins, addr, sizeof(ins)))
return -EFAULT;
if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)
return -EFAULT;
if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)
@@
-849,6
+845,10
@@
static int opl3_load_patch(int dev, int format, const char __user *addr,
static void opl3_panning(int dev, int voice, int value)
{
static void opl3_panning(int dev, int voice, int value)
{
+
+ if (voice < 0 || voice >= devc->nr_voice)
+ return;
+
devc->voc[voice].panning = value;
}
devc->voc[voice].panning = value;
}
@@
-1066,8
+1066,15
@@
static int opl3_alloc_voice(int dev, int chn, int note, struct voice_alloc_info
static void opl3_setup_voice(int dev, int voice, int chn)
{
static void opl3_setup_voice(int dev, int voice, int chn)
{
- struct channel_info *info =
- &synth_devs[dev]->chn_info[chn];
+ struct channel_info *info;
+
+ if (voice < 0 || voice >= devc->nr_voice)
+ return;
+
+ if (chn < 0 || chn > 15)
+ return;
+
+ info = &synth_devs[dev]->chn_info[chn];
opl3_set_instr(dev, voice, info->pgm_num);
opl3_set_instr(dev, voice, info->pgm_num);