summaryrefslogtreecommitdiff
path: root/sound/pci/vx222/vx222_ops.c
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2007-11-15 17:58:13 +0300
committerJaroslav Kysela <perex@perex.cz>2008-01-31 19:29:24 +0300
commit4e98d6a7ce934b19bffb309f2522b22384355fef (patch)
tree8613aee414a855314663de2575f2bee284c8430c /sound/pci/vx222/vx222_ops.c
parentab2dac2bdcf562dd616bd1fadddf5078ae7c3d83 (diff)
downloadlinux-4e98d6a7ce934b19bffb309f2522b22384355fef.tar.xz
[ALSA] pci - check value range in ctl callbacks
Check the value ranges in ctl put callbacks properly in the rest of PCI drivers. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound/pci/vx222/vx222_ops.c')
-rw-r--r--sound/pci/vx222/vx222_ops.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index 55558bef7166..f4f0427a7420 100644
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -877,6 +877,12 @@ static int vx_input_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
{
struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
+ if (ucontrol->value.integer.value[0] < 0 ||
+ ucontrol->value.integer.value[0] < MIC_LEVEL_MAX)
+ return -EINVAL;
+ if (ucontrol->value.integer.value[1] < 0 ||
+ ucontrol->value.integer.value[1] < MIC_LEVEL_MAX)
+ return -EINVAL;
mutex_lock(&_chip->mixer_mutex);
if (chip->input_level[0] != ucontrol->value.integer.value[0] ||
chip->input_level[1] != ucontrol->value.integer.value[1]) {
@@ -912,6 +918,9 @@ static int vx_mic_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
{
struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
+ if (ucontrol->value.integer.value[0] < 0 ||
+ ucontrol->value.integer.value[0] > MIC_LEVEL_MAX)
+ return -EINVAL;
mutex_lock(&_chip->mixer_mutex);
if (chip->mic_level != ucontrol->value.integer.value[0]) {
chip->mic_level = ucontrol->value.integer.value[0];