⬢ DragonFlyBSD Kernel Audit
DF-3996 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
--- a/sys/dev/sound/pci/envy24.c
+++ b/sys/dev/sound/pci/envy24.c
@@ -1412,7 +1412,7 @@ envy24_p32sl(struct sc_chinfo *ch)
 	length = sndbuf_getready(ch->buffer) / 8;
 	dmabuf = ch->parent->pbuf;
 	data = (u_int32_t *)ch->data;
 	src = sndbuf_getreadyptr(ch->buffer) / 4;
-	dst = src / 2 + ch->offset;
+	dst = (src / 2 + ch->offset) % (ch->size / 8);
 	ssize = ch->size / 4;
 	dsize = ch->size / 8;
 	slot = ch->num * 2;
@@ -1444,7 +1444,7 @@ envy24_p16sl(struct sc_chinfo *ch)
 	length = sndbuf_getready(ch->buffer) / 4;
 	dmabuf = ch->parent->pbuf;
 	data = (u_int16_t *)ch->data;
 	src = sndbuf_getreadyptr(ch->buffer) / 2;
-	dst = src / 2 + ch->offset;
+	dst = (src / 2 + ch->offset) % (ch->size / 4);
 	ssize = ch->size / 2;
 	dsize = ch->size / 4;
 	slot = ch->num * 2;
@@ -1486,7 +1486,7 @@ envy24_p8u(struct sc_chinfo *ch)
 	length = sndbuf_getready(ch->buffer) / 2;
 	dmabuf = ch->parent->pbuf;
 	data = (u_int8_t *)ch->data;
 	src = sndbuf_getreadyptr(ch->buffer);
-	dst = src / 2 + ch->offset;
+	dst = (src / 2 + ch->offset) % (ch->size / 4);
 	ssize = ch->size;
 	dsize = ch->size / 4;
 	slot = ch->num * 2;
@@ -1516,7 +1516,7 @@ envy24_r32sl(struct sc_chinfo *ch)
 	length = sndbuf_getfree(ch->buffer) / 8;
 	dmabuf = ch->parent->rbuf;
 	data = (u_int32_t *)ch->data;
 	dst = sndbuf_getfreeptr(ch->buffer) / 4;
-	src = dst / 2 + ch->offset;
+	src = (dst / 2 + ch->offset) % (ch->size / 8);
 	dsize = ch->size / 4;
 	ssize = ch->size / 8;
 	slot = (ch->num - ENVY24_CHAN_REC_ADC1) * 2;
@@ -1547,7 +1547,7 @@ envy24_r16sl(struct sc_chinfo *ch)
 	length = sndbuf_getfree(ch->buffer) / 4;
 	dmabuf = ch->parent->rbuf;
 	data = (u_int16_t *)ch->data;
 	dst = sndbuf_getfreeptr(ch->buffer) / 2;
-	src = dst / 2 + ch->offset;
+	src = (dst / 2 + ch->offset) % (ch->size / 8);
 	dsize = ch->size / 2;
 	ssize = ch->size / 8;
 	slot = (ch->num - ENVY24_CHAN_REC_ADC1) * 2;