From: Takashi Sakamoto Date: Wed, 27 May 2015 15:02:59 +0000 (+0900) Subject: ALSA: firewire-lib: fix buffer-over-run when detecting packet discontinuity X-Git-Tag: omap-for-v4.3/legacy-v2-signed~142^2~61 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=31ea49baa1aa97f882ee3da8142ec5a9dac509c2;p=pandora-kernel.git ALSA: firewire-lib: fix buffer-over-run when detecting packet discontinuity When detecting packet discontinuity, handle_in_packet() returns minus value and this value is assigned to unsigned int variable, then the variable has huge value. As a result, the variable causes buffer-over-run in handle_out_packet(). This brings invalid page request and system hangup. This commit fixes the bug to add a new argument into handle_in_packet() and the number of handled data blocks is assignd to it. The function return value is just used to check error. I also considered to change the type of local variable to 'int' in in_stream_callback(). This idea is based on type-conversion in C standard, while it may cause future problems when adding more works. Thus, I dropped this idea. Fixes: 6fc6b9ce41c6('ALSA: firewire-lib: pass the number of data blocks in incoming packets to outgoing packets') Reported-by: Dan Carpenter Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai --- Reading git-diff-tree failed