Changeset 772 for GPL/trunk/alsa-kernel/synth/emux/soundfont.c

Timestamp:

Apr 19, 2025, 8:08:37 PM (4 months ago)

Author:

David Azarewicz

Message:

Merge in changes from 6.6-LTS branch.
Fixed additional 25+ problems.

Location:

GPL/trunk

Files:

• . (modified) (1 prop)
• alsa-kernel/synth/emux/soundfont.c (modified) (4 diffs)

GPL/trunk/alsa-kernel/synth/emux/soundfont.c

@@ -704 +704 @@
         struct soundfont_sample_info sample_info;
         struct snd_sf_sample *sp;
-        long off;
 
         /* patch must be opened */
@@ -714 +713 @@
                 return -EINVAL;
 
+        if (count < (long)sizeof(sample_info)) {
+                return -EINVAL;
+        }
         if (copy_from_user(&sample_info, data, sizeof(sample_info)))
                 return -EFAULT;
-
-        off = sizeof(sample_info);
-
-        if (sample_info.size != (count-off)/2)
+        data += sizeof(sample_info);
+        count -= sizeof(sample_info);
+
+        // SoundFont uses S16LE samples.
+        if (sample_info.size * 2 != count)
                 return -EINVAL;
 
@@ -747 +750 @@
                 rc = sflist->callback.sample_new
                         (sflist->callback.private_data, sp, sflist->memhdr,
-                         data + off, count - off);
+                         data, count);
                 if (rc < 0) {
                         sf_sample_delete(sflist, sf, sp);
@@ -960 +963 @@
         if (copy_from_user(&patch, data, sizeof(patch)))
                 return -EFAULT;
-        
         count -= sizeof(patch);
         data += sizeof(patch);
+
+        if ((patch.len << (patch.mode & WAVE_16_BITS ? 1 : 0)) != count)
+                return -EINVAL;
 
         sf = newsf(sflist, SNDRV_SFNT_PAT_TYPE_GUS|SNDRV_SFNT_PAT_SHARED, NULL);