diff options
| -rw-r--r-- | sound/core/pcm_lib.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c index 678b96aec203..0632ebf0d971 100644 --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -1792,6 +1792,11 @@ static int snd_pcm_lib_ioctl_channel_info(struct snd_pcm_substream *substream, switch (runtime->access) { case SNDRV_PCM_ACCESS_MMAP_INTERLEAVED: case SNDRV_PCM_ACCESS_RW_INTERLEAVED: + if ((UINT_MAX/width) < info->channel) { + snd_printd("%s: integer overflow while multiply\n", + __func__); + return -EINVAL; + } info->first = info->channel * width; info->step = runtime->channels * width; break; @@ -1799,6 +1804,12 @@ static int snd_pcm_lib_ioctl_channel_info(struct snd_pcm_substream *substream, case SNDRV_PCM_ACCESS_RW_NONINTERLEAVED: { size_t size = runtime->dma_bytes / runtime->channels; + + if ((size > 0) && ((UINT_MAX/(size * 8)) < info->channel)) { + snd_printd("%s: integer overflow while multiply\n", + __func__); + return -EINVAL; + } info->first = info->channel * size * 8; info->step = width; break; |