diff mbox

[3.13.y-ckt,stable] Patch "ALSA: control: Add sanity checks for user ctl id name string" has been added to staging queue

Message ID 1428357522-17312-1-git-send-email-kamal@canonical.com
State New
Headers show

Commit Message

Kamal Mostafa April 6, 2015, 9:58 p.m. UTC
This is a note to let you know that I have just added a patch titled

    ALSA: control: Add sanity checks for user ctl id name string

to the linux-3.13.y-queue branch of the 3.13.y-ckt extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue

This patch is scheduled to be released in version 3.13.11-ckt19.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.13.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From e6407d94543931d35f52b9a862077630c1efedb7 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 11 Mar 2015 18:12:49 +0100
Subject: ALSA: control: Add sanity checks for user ctl id name string

commit be3bb8236db2d0fcd705062ae2e2a9d75131222f upstream.

There was no check about the id string of user control elements, so we
accepted even a control element with an empty string, which is
obviously bogus.  This patch adds more sanity checks of id strings.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/core/control.c | 4 ++++
 1 file changed, 4 insertions(+)

--
1.9.1
diff mbox

Patch

diff --git a/sound/core/control.c b/sound/core/control.c
index 98a29b2..f2082a3 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1168,6 +1168,10 @@  static int snd_ctl_elem_add(struct snd_ctl_file *file,

 	if (info->count < 1)
 		return -EINVAL;
+	if (!*info->id.name)
+		return -EINVAL;
+	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
+		return -EINVAL;
 	access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
 		(info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
 				 SNDRV_CTL_ELEM_ACCESS_INACTIVE|