From: Dan Carpenter <dan.carpenter@oracle.com> Date: Thu, 5 Mar 2015 17:49:06 +0000 (+0300) Subject: ALSA: opl3: small array underflow X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=d124380674b58f62d0ef974630d74d67bb8afeb0;p=openwrt%2Fstaging%2Fblogic.git ALSA: opl3: small array underflow There is a missing lower bound check on "pitchbend" so it means we can read up to 6 elements before the start of the opl3_note_table[] array. Thanks to Clemens Ladisch for his help with this patch. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> --- diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c index f62780ed64ad..7821b07415a7 100644 --- a/sound/drivers/opl3/opl3_midi.c +++ b/sound/drivers/opl3/opl3_midi.c @@ -105,6 +105,8 @@ static void snd_opl3_calc_pitch(unsigned char *fnum, unsigned char *blocknum, int pitchbend = chan->midi_pitchbend; int segment; + if (pitchbend < -0x2000) + pitchbend = -0x2000; if (pitchbend > 0x1FFF) pitchbend = 0x1FFF;