From d05ab185b770de96399766be6bcb5769ab99bc09 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 15 Nov 2007 16:13:32 +0100 Subject: [ALSA] vxpocket - Check value range in ctl callbacks Check the value ranges in ctl put callbacks in vxpocket driver. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela --- sound/drivers/vx/vx_mixer.c | 67 ++++++++++++++++++++++++++++++++------------- 1 file changed, 48 insertions(+), 19 deletions(-) (limited to 'sound/drivers') diff --git a/sound/drivers/vx/vx_mixer.c b/sound/drivers/vx/vx_mixer.c index b8fcd79a7e11..a37f0a8f17af 100644 --- a/sound/drivers/vx/vx_mixer.c +++ b/sound/drivers/vx/vx_mixer.c @@ -439,14 +439,19 @@ static int vx_output_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_ele { struct vx_core *chip = snd_kcontrol_chip(kcontrol); int codec = kcontrol->id.index; + unsigned int val[2], vmax; + + vmax = chip->hw->output_level_max; + val[0] = ucontrol->value.integer.value[0]; + val[1] = ucontrol->value.integer.value[1]; + if (val[0] > vmax || val[1] > vmax) + return -EINVAL; mutex_lock(&chip->mixer_mutex); - if (ucontrol->value.integer.value[0] != chip->output_level[codec][0] || - ucontrol->value.integer.value[1] != chip->output_level[codec][1]) { - vx_set_analog_output_level(chip, codec, - ucontrol->value.integer.value[0], - ucontrol->value.integer.value[1]); - chip->output_level[codec][0] = ucontrol->value.integer.value[0]; - chip->output_level[codec][1] = ucontrol->value.integer.value[1]; + if (val[0] != chip->output_level[codec][0] || + val[1] != chip->output_level[codec][1]) { + vx_set_analog_output_level(chip, codec, val[0], val[1]); + chip->output_level[codec][0] = val[0]; + chip->output_level[codec][1] = val[1]; mutex_unlock(&chip->mixer_mutex); return 1; } @@ -506,6 +511,14 @@ static int vx_audio_src_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v static int vx_audio_src_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { struct vx_core *chip = snd_kcontrol_chip(kcontrol); + + if (chip->type >= VX_TYPE_VXPOCKET) { + if (ucontrol->value.enumerated.item[0] > 2) + return -EINVAL; + } else { + if (ucontrol->value.enumerated.item[0] > 1) + return -EINVAL; + } mutex_lock(&chip->mixer_mutex); if (chip->audio_source_target != ucontrol->value.enumerated.item[0]) { chip->audio_source_target = ucontrol->value.enumerated.item[0]; @@ -554,6 +567,9 @@ static int vx_clock_mode_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ static int vx_clock_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol) { struct vx_core *chip = snd_kcontrol_chip(kcontrol); + + if (ucontrol->value.enumerated.item[0] > 2) + return -EINVAL; mutex_lock(&chip->mixer_mutex); if (chip->clock_mode != ucontrol->value.enumerated.item[0]) { chip->clock_mode = ucontrol->value.enumerated.item[0]; @@ -603,12 +619,17 @@ static int vx_audio_gain_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ struct vx_core *chip = snd_kcontrol_chip(kcontrol); int audio = kcontrol->private_value & 0xff; int capture = (kcontrol->private_value >> 8) & 1; + unsigned int val[2]; + val[0] = ucontrol->value.integer.value[0]; + val[1] = ucontrol->value.integer.value[1]; + if (val[0] > CVAL_MAX || val[1] > CVAL_MAX) + return -EINVAL; mutex_lock(&chip->mixer_mutex); - if (ucontrol->value.integer.value[0] != chip->audio_gain[capture][audio] || - ucontrol->value.integer.value[1] != chip->audio_gain[capture][audio+1]) { - vx_set_audio_gain(chip, audio, capture, ucontrol->value.integer.value[0]); - vx_set_audio_gain(chip, audio+1, capture, ucontrol->value.integer.value[1]); + if (val[0] != chip->audio_gain[capture][audio] || + val[1] != chip->audio_gain[capture][audio+1]) { + vx_set_audio_gain(chip, audio, capture, val[0]); + vx_set_audio_gain(chip, audio+1, capture, val[1]); mutex_unlock(&chip->mixer_mutex); return 1; } @@ -632,13 +653,19 @@ static int vx_audio_monitor_put(struct snd_kcontrol *kcontrol, struct snd_ctl_el { struct vx_core *chip = snd_kcontrol_chip(kcontrol); int audio = kcontrol->private_value & 0xff; + unsigned int val[2]; + + val[0] = ucontrol->value.integer.value[0]; + val[1] = ucontrol->value.integer.value[1]; + if (val[0] > CVAL_MAX || val[1] > CVAL_MAX) + return -EINVAL; mutex_lock(&chip->mixer_mutex); - if (ucontrol->value.integer.value[0] != chip->audio_monitor[audio] || - ucontrol->value.integer.value[1] != chip->audio_monitor[audio+1]) { - vx_set_monitor_level(chip, audio, ucontrol->value.integer.value[0], + if (val[0] != chip->audio_monitor[audio] || + val[1] != chip->audio_monitor[audio+1]) { + vx_set_monitor_level(chip, audio, val[0], chip->audio_monitor_active[audio]); - vx_set_monitor_level(chip, audio+1, ucontrol->value.integer.value[1], + vx_set_monitor_level(chip, audio+1, val[1], chip->audio_monitor_active[audio+1]); mutex_unlock(&chip->mixer_mutex); return 1; @@ -669,8 +696,10 @@ static int vx_audio_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_va mutex_lock(&chip->mixer_mutex); if (ucontrol->value.integer.value[0] != chip->audio_active[audio] || ucontrol->value.integer.value[1] != chip->audio_active[audio+1]) { - vx_set_audio_switch(chip, audio, ucontrol->value.integer.value[0]); - vx_set_audio_switch(chip, audio+1, ucontrol->value.integer.value[1]); + vx_set_audio_switch(chip, audio, + !!ucontrol->value.integer.value[0]); + vx_set_audio_switch(chip, audio+1, + !!ucontrol->value.integer.value[1]); mutex_unlock(&chip->mixer_mutex); return 1; } @@ -699,9 +728,9 @@ static int vx_monitor_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ if (ucontrol->value.integer.value[0] != chip->audio_monitor_active[audio] || ucontrol->value.integer.value[1] != chip->audio_monitor_active[audio+1]) { vx_set_monitor_level(chip, audio, chip->audio_monitor[audio], - ucontrol->value.integer.value[0]); + !!ucontrol->value.integer.value[0]); vx_set_monitor_level(chip, audio+1, chip->audio_monitor[audio+1], - ucontrol->value.integer.value[1]); + !!ucontrol->value.integer.value[1]); mutex_unlock(&chip->mixer_mutex); return 1; } -- cgit v1.2.3