Messages in this thread | | | Subject | Re: Fix sequencer missing negative bound check | From | Valdis.Kletnieks@vt ... | Date | Wed, 15 Mar 2006 22:07:20 -0500 |
| |
On Thu, 16 Mar 2006 09:19:11 +0800, Eugene Teo said: > dev is missing a negative bound check. > > Signed-off-by: Eugene Teo <eugene.teo@eugeneteo.net> > > --- linux-2.6/sound/oss/sequencer.c~ 2006-03-15 10:05:45.000000000 +0800 > +++ linux-2.6/sound/oss/sequencer.c 2006-03-16 09:06:59.000000000 +0800 > @@ -713,7 +713,7 @@ > int i, l = 0; > unsigned char *buf = &event_rec[2]; > > - if ((int) dev > max_synthdev) > + if (dev < 0 || dev >= max_synthdev) > return; > if (!(synth_open_mask & (1 << dev))) > return;
Erm??
Looking at a bit more context for the function:
static void seq_sysex_message(unsigned char *event_rec) { int dev = event_rec[1]; int i, l = 0; unsigned char *buf = &event_rec[2];
if ((int) dev > max_synthdev) return; if (!(synth_open_mask & (1 << dev))) return; if (!synth_devs[dev]) return;
that 'int dev' came out of an 'unsigned char *' - as such, I doubt you can get a negative value. If anything, it should be 'unsigned int dev'. [unhandled content-type:application/pgp-signature] | |