forked from luck/tmp_suning_uos_patched
31ea49baa1
When detecting packet discontinuity, handle_in_packet() returns minus value and this value is assigned to unsigned int variable, then the variable has huge value. As a result, the variable causes buffer-over-run in handle_out_packet(). This brings invalid page request and system hangup. This commit fixes the bug to add a new argument into handle_in_packet() and the number of handled data blocks is assignd to it. The function return value is just used to check error. I also considered to change the type of local variable to 'int' in in_stream_callback(). This idea is based on type-conversion in C standard, while it may cause future problems when adding more works. Thus, I dropped this idea. Fixes: 6fc6b9ce41c6('ALSA: firewire-lib: pass the number of data blocks in incoming packets to outgoing packets') Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
aoa | ||
arm | ||
atmel | ||
core | ||
drivers | ||
firewire | ||
hda | ||
i2c | ||
isa | ||
mips | ||
oss | ||
parisc | ||
pci | ||
pcmcia | ||
ppc | ||
sh | ||
soc | ||
sparc | ||
spi | ||
synth | ||
usb | ||
ac97_bus.c | ||
Kconfig | ||
last.c | ||
Makefile | ||
sound_core.c | ||
sound_firmware.c |