[ALSA] vxpocket - Check value range in ctl callbacks

Check the value ranges in ctl put callbacks in vxpocket driver.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/sound/drivers/vx/vx_mixer.c b/sound/drivers/vx/vx_mixer.c
index b8fcd79a7e11ea041c7b45f90adc02a204eb1632..a37f0a8f17af46a9b4e3d545ca136b33aee04cd8 100644 (file)
--- a/sound/drivers/vx/vx_mixer.c
+++ b/sound/drivers/vx/vx_mixer.c
@@ -439,14 +439,19 @@ static int vx_output_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_ele
 {
        struct vx_core *chip = snd_kcontrol_chip(kcontrol);
        int codec = kcontrol->id.index;
+       unsigned int val[2], vmax;
+
+       vmax = chip->hw->output_level_max;
+       val[0] = ucontrol->value.integer.value[0];
+       val[1] = ucontrol->value.integer.value[1];
+       if (val[0] > vmax || val[1] > vmax)
+               return -EINVAL;
        mutex_lock(&chip->mixer_mutex);
-       if (ucontrol->value.integer.value[0] != chip->output_level[codec][0] ||
-           ucontrol->value.integer.value[1] != chip->output_level[codec][1]) {
-               vx_set_analog_output_level(chip, codec,
-                                          ucontrol->value.integer.value[0],
-                                          ucontrol->value.integer.value[1]);
-               chip->output_level[codec][0] = ucontrol->value.integer.value[0];
-               chip->output_level[codec][1] = ucontrol->value.integer.value[1];
+       if (val[0] != chip->output_level[codec][0] ||
+           val[1] != chip->output_level[codec][1]) {
+               vx_set_analog_output_level(chip, codec, val[0], val[1]);
+               chip->output_level[codec][0] = val[0];
+               chip->output_level[codec][1] = val[1];
                mutex_unlock(&chip->mixer_mutex);
                return 1;
        }
@@ -506,6 +511,14 @@ static int vx_audio_src_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
 static int vx_audio_src_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol)
 {
        struct vx_core *chip = snd_kcontrol_chip(kcontrol);
+
+       if (chip->type >= VX_TYPE_VXPOCKET) {
+               if (ucontrol->value.enumerated.item[0] > 2)
+                       return -EINVAL;
+       } else {
+               if (ucontrol->value.enumerated.item[0] > 1)
+                       return -EINVAL;
+       }
        mutex_lock(&chip->mixer_mutex);
        if (chip->audio_source_target != ucontrol->value.enumerated.item[0]) {
                chip->audio_source_target = ucontrol->value.enumerated.item[0];
@@ -554,6 +567,9 @@ static int vx_clock_mode_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
 static int vx_clock_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol)
 {
        struct vx_core *chip = snd_kcontrol_chip(kcontrol);
+
+       if (ucontrol->value.enumerated.item[0] > 2)
+               return -EINVAL;
        mutex_lock(&chip->mixer_mutex);
        if (chip->clock_mode != ucontrol->value.enumerated.item[0]) {
                chip->clock_mode = ucontrol->value.enumerated.item[0];
@@ -603,12 +619,17 @@ static int vx_audio_gain_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
        struct vx_core *chip = snd_kcontrol_chip(kcontrol);
        int audio = kcontrol->private_value & 0xff;
        int capture = (kcontrol->private_value >> 8) & 1;
+       unsigned int val[2];
 
+       val[0] = ucontrol->value.integer.value[0];
+       val[1] = ucontrol->value.integer.value[1];
+       if (val[0] > CVAL_MAX || val[1] > CVAL_MAX)
+               return -EINVAL;
        mutex_lock(&chip->mixer_mutex);
-       if (ucontrol->value.integer.value[0] != chip->audio_gain[capture][audio] ||
-           ucontrol->value.integer.value[1] != chip->audio_gain[capture][audio+1]) {
-               vx_set_audio_gain(chip, audio, capture, ucontrol->value.integer.value[0]);
-               vx_set_audio_gain(chip, audio+1, capture, ucontrol->value.integer.value[1]);
+       if (val[0] != chip->audio_gain[capture][audio] ||
+           val[1] != chip->audio_gain[capture][audio+1]) {
+               vx_set_audio_gain(chip, audio, capture, val[0]);
+               vx_set_audio_gain(chip, audio+1, capture, val[1]);
                mutex_unlock(&chip->mixer_mutex);
                return 1;
        }
@@ -632,13 +653,19 @@ static int vx_audio_monitor_put(struct snd_kcontrol *kcontrol, struct snd_ctl_el
 {
        struct vx_core *chip = snd_kcontrol_chip(kcontrol);
        int audio = kcontrol->private_value & 0xff;
+       unsigned int val[2];
+
+       val[0] = ucontrol->value.integer.value[0];
+       val[1] = ucontrol->value.integer.value[1];
+       if (val[0] > CVAL_MAX || val[1] > CVAL_MAX)
+               return -EINVAL;
 
        mutex_lock(&chip->mixer_mutex);
-       if (ucontrol->value.integer.value[0] != chip->audio_monitor[audio] ||
-           ucontrol->value.integer.value[1] != chip->audio_monitor[audio+1]) {
-               vx_set_monitor_level(chip, audio, ucontrol->value.integer.value[0],
+       if (val[0] != chip->audio_monitor[audio] ||
+           val[1] != chip->audio_monitor[audio+1]) {
+               vx_set_monitor_level(chip, audio, val[0],
                                     chip->audio_monitor_active[audio]);
-               vx_set_monitor_level(chip, audio+1, ucontrol->value.integer.value[1],
+               vx_set_monitor_level(chip, audio+1, val[1],
                                     chip->audio_monitor_active[audio+1]);
                mutex_unlock(&chip->mixer_mutex);
                return 1;
@@ -669,8 +696,10 @@ static int vx_audio_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_va
        mutex_lock(&chip->mixer_mutex);
        if (ucontrol->value.integer.value[0] != chip->audio_active[audio] ||
            ucontrol->value.integer.value[1] != chip->audio_active[audio+1]) {
-               vx_set_audio_switch(chip, audio, ucontrol->value.integer.value[0]);
-               vx_set_audio_switch(chip, audio+1, ucontrol->value.integer.value[1]);
+               vx_set_audio_switch(chip, audio,
+                                   !!ucontrol->value.integer.value[0]);
+               vx_set_audio_switch(chip, audio+1,
+                                   !!ucontrol->value.integer.value[1]);
                mutex_unlock(&chip->mixer_mutex);
                return 1;
        }
@@ -699,9 +728,9 @@ static int vx_monitor_sw_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
        if (ucontrol->value.integer.value[0] != chip->audio_monitor_active[audio] ||
            ucontrol->value.integer.value[1] != chip->audio_monitor_active[audio+1]) {
                vx_set_monitor_level(chip, audio, chip->audio_monitor[audio],
-                                    ucontrol->value.integer.value[0]);
+                                    !!ucontrol->value.integer.value[0]);
                vx_set_monitor_level(chip, audio+1, chip->audio_monitor[audio+1],
-                                    ucontrol->value.integer.value[1]);
+                                    !!ucontrol->value.integer.value[1]);
                mutex_unlock(&chip->mixer_mutex);
                return 1;
        }

diff --git a/sound/pcmcia/vx/vxp_mixer.c b/sound/pcmcia/vx/vxp_mixer.c
index 1eff158b8687327b6e4584bd829def4122abf5da..bf9d3b37d6bc26497d31f6bb3964f6321b81bfa4 100644 (file)
--- a/sound/pcmcia/vx/vxp_mixer.c
+++ b/sound/pcmcia/vx/vxp_mixer.c
@@ -53,6 +53,10 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
 {
        struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
        struct snd_vxpocket *chip = (struct snd_vxpocket *)_chip;
+       unsigned int val = ucontrol->value.integer.value[0];
+
+       if (val > MIC_LEVEL_MAX)
+               return -EINVAL;
        mutex_lock(&_chip->mixer_mutex);
        if (chip->mic_level != ucontrol->value.integer.value[0]) {
                vx_set_mic_level(_chip, ucontrol->value.integer.value[0]);
@@ -94,10 +98,11 @@ static int vx_mic_boost_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
 {
        struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
        struct snd_vxpocket *chip = (struct snd_vxpocket *)_chip;
+       int val = !!ucontrol->value.integer.value[0];
        mutex_lock(&_chip->mixer_mutex);
-       if (chip->mic_level != ucontrol->value.integer.value[0]) {
-               vx_set_mic_boost(_chip, ucontrol->value.integer.value[0]);
-               chip->mic_level = ucontrol->value.integer.value[0];
+       if (chip->mic_level != val) {
+               vx_set_mic_boost(_chip, val);
+               chip->mic_level = val;
                mutex_unlock(&_chip->mixer_mutex);
                return 1;
        }