pcm: cap route plugin ttable channel dimensions at 1024

csize/ssize grew from config-supplied channel indices with no upper
bound before malloc(csize * ssize * sizeof(entry)). Cap both at 1024,
consistent with other PCM plugins.

[ fixed coding style -- tiwai ]

Closes: https://github.com/alsa-project/alsa-lib/pull/527
Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/src/pcm/pcm_route.c b/src/pcm/pcm_route.c
index 3836dcc3a4fa78c7d2641fc1887d7dacf72f64ce..4f1e004e7132c41c936429836d8b34fe23b42f87 100644 (file)
--- a/src/pcm/pcm_route.c
+++ b/src/pcm/pcm_route.c
@@ -1098,6 +1098,11 @@ static int _snd_pcm_route_determine_ttable(snd_config_t *tt,
                }
                if (cchannel + 1 > csize)
                        csize = cchannel + 1;
+               if (csize > 1024) {
+                       SNDERR("route: client channel %d exceeds max (1024)",
+                              cchannel);
+                       return -EINVAL;
+               }
                if (snd_config_get_type(in) != SND_CONFIG_TYPE_COMPOUND)
                        return -EINVAL;
                snd_config_for_each(j, jnext, in) {
@@ -1113,6 +1118,11 @@ static int _snd_pcm_route_determine_ttable(snd_config_t *tt,
                        }
                        if (schannel + 1 > ssize)
                                ssize = schannel + 1;
+                       if (ssize > 1024) {
+                               SNDERR("route: slave channel %d exceeds max (1024)",
+                                      schannel);
+                               return -EINVAL;
+                       }
                }
        }
        if (csize == 0 || ssize == 0) {