dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

sound: oss/sb_audio: prevent divide by zero bug 

Speed comes from get_user() in audio_ioctl().  We use it to set the "s"
variable before clamping it to valid values so it could lead to a divide
by zero bug.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Dan Carpenter 2012-08-18 18:55:15 +03:00 committed by Takashi Iwai
parent 5e68fb3cab
commit 94f3ec6b22
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/oss/sb_audio.c
View File

@ -575,13 +575,15 @@ static int jazz16_audio_set_speed(int dev, int speed)
if (speed > 0)
{
int tmp;
int s = speed * devc->channels;
int s;
if (speed < 5000)
speed = 5000;
if (speed > 44100)
speed = 44100;
s = speed * devc->channels;
devc->tconst = (256 - ((1000000 + s / 2) / s)) & 0xff;
tmp = 256 - devc->tconst;