Reject channel counts above 16 and sample rates above 384 kHz in audio_validate_settings(). Without upper bounds, extreme values can cause excessive memory allocation or arithmetic overflow downstream.
Reported-by: Pavee Hui <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- audio/audio-mixeng-be.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/audio/audio-mixeng-be.c b/audio/audio-mixeng-be.c index f7d73d85608c..f6fd5014e0e0 100644 --- a/audio/audio-mixeng-be.c +++ b/audio/audio-mixeng-be.c @@ -78,7 +78,7 @@ static int audio_validate_settings (const struct audsettings *as) { int invalid; - invalid = as->nchannels < 1; + invalid = as->nchannels < 1 || as->nchannels > 16; switch (as->fmt) { case AUDIO_FORMAT_S8: @@ -94,7 +94,7 @@ static int audio_validate_settings (const struct audsettings *as) break; } - invalid |= as->freq <= 0; + invalid |= as->freq <= 0 || as->freq > 384000; return invalid ? -1 : 0; } -- 2.56.0.rc0.29.g47ce80527c56
