Messages in this thread | | | Date | Tue, 16 Feb 2010 11:00:57 +0100 | From | Clemens Ladisch <> | Subject | Re: bug list: range checking issues |
| |
Dan Carpenter wrote: > sound/core/seq/oss/seq_oss_init.c +276 snd_seq_oss_open(102) error: buffer overflow 'client_table' 16 <= 16
False positive, probably because the source of the assignment is checked for overflow:
195: dp->index = i; if (i >= SNDRV_SEQ_OSS_MAX_CLIENTS) { ... goto _error; ... 276: client_table[dp->index] = dp;
> sound/oss/sequencer.c +1638 compute_finetune(45) error: buffer overflow 'semitone_tuning' 24 <= 99
False positive; bend is at most 2399, so semitones is at most 23. The "if (semitones > 99) semitones = 99;" check is completely bogus.
> sound/core/pcm_native.c +320 snd_pcm_hw_refine(159) warn: buffer overflow 'params->masks' 3 <= 10
This looks correct; the channels parameter is an interval, not a mask.
if (!params->fifo_size) { if (snd_mask_min(¶ms->masks[SNDRV_PCM_HW_PARAM_FORMAT]) == snd_mask_max(¶ms->masks[SNDRV_PCM_HW_PARAM_FORMAT]) && snd_mask_min(¶ms->masks[SNDRV_PCM_HW_PARAM_CHANNELS]) == snd_mask_max(¶ms->masks[SNDRV_PCM_HW_PARAM_CHANNELS])) {
Jaroslav, I guess this should have been snd_interval_min/max? And shouldn't the parameters be accessed with hw_param_mask/interval?
Regards, Clemens
| |