tlv: Check out of range dB with SND_CTL_TLVT_DB_RANGE

When converting from dB value to raw value, the control's
full range was not checked in case of SND_CTL_TLVT_DB_RANGE.

Check out of range dB values, and return apropriate raw
value for the caller.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@nokia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/src/control/tlv.c b/src/control/tlv.c
index 0ff052eefe09857271272ab48e9a4c44168c59a8..9f26f355631b85b4f404f0a622f353dc7a75f4aa 100644 (file)
--- a/src/control/tlv.c
+++ b/src/control/tlv.c
@@ -285,13 +285,23 @@ int snd_tlv_convert_from_dB(unsigned int *tlv, long rangemin, long rangemax,
 {
        switch (tlv[0]) {
        case SND_CTL_TLVT_DB_RANGE: {
+               long dbmin, dbmax;
                unsigned int pos, len;
                len = int_index(tlv[1]);
                if (len > MAX_TLV_RANGE_SIZE)
                        return -EINVAL;
+               if (snd_tlv_get_dB_range(tlv, rangemin, rangemax,
+                                        &dbmin, &dbmax))
+                       return -EINVAL;
+               if (db_gain <= dbmin) {
+                       *value = rangemin;
+                       return 0;
+               } else if (db_gain >= dbmax) {
+                       *value = rangemax;
+                       return 0;
+               }
                pos = 2;
                while (pos + 4 <= len) {
-                       long dbmin, dbmax;
                        rangemin = (int)tlv[pos];
                        rangemax = (int)tlv[pos + 1];
                        if (!snd_tlv_get_dB_range(tlv + pos + 2,