From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 24 Aug 2023 17:24:03 +0000 (+0200)
Subject: seq: Add overflow check in snd_seq_ev_set_ump_data()
X-Git-Tag: v1.2.10~29
X-Git-Url: https://git.alsa-project.org/?a=commitdiff_plain;h=91bbe55894458a98a6f9f1d8aad6b237c7d22f3f;p=alsa-lib.git

seq: Add overflow check in snd_seq_ev_set_ump_data()

It's better to add a sanity check than sorry for breaking.
Now the function return -EINVAL.

Closes: https://github.com/alsa-project/alsa-lib/issues/346
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/include/seqmid.h b/include/seqmid.h
index 4089ac20..da346999 100644
--- a/include/seqmid.h
+++ b/include/seqmid.h
@@ -300,10 +300,13 @@ static inline void snd_seq_ev_set_ump(snd_seq_ump_event_t *ev)
  * \param data UMP packet data
  * \param bytes UMP packet size in bytes
  */
-static inline void snd_seq_ev_set_ump_data(snd_seq_ump_event_t *ev, void *data, size_t bytes)
+static inline int snd_seq_ev_set_ump_data(snd_seq_ump_event_t *ev, void *data, size_t bytes)
 {
+	if (bytes > 16)
+		return -EINVAL;
 	snd_seq_ev_set_ump(ev);
 	memcpy(ev->ump, data, bytes);
+	return 0;
 }
 
 /* set and send a queue control event */