ALSA: usb-audio: avoid integer overflow in create_fixed_stream_quirk()

[pandora-kernel.git] / sound / usb / quirks.c

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 42eeee8..9c82f8b 100644 (file)
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -132,10 +132,14 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
        unsigned *rate_table = NULL;
 
        fp = kmemdup(quirk->data, sizeof(*fp), GFP_KERNEL);
-       if (! fp) {
+       if (!fp) {
                snd_printk(KERN_ERR "cannot memdup\n");
                return -ENOMEM;
        }
+       if (fp->nr_rates > MAX_NR_RATES) {
+               kfree(fp);
+               return -EINVAL;
+       }
        if (fp->nr_rates > 0) {
                rate_table = kmemdup(fp->rate_table,
                                     sizeof(int) * fp->nr_rates, GFP_KERNEL);