⬢ DragonFlyBSD Kernel Audit
DF-3998 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
--- a/sys/dev/sound/pci/envy24ht.c
+++ b/sys/dev/sound/pci/envy24ht.c
@@ -1321,7 +1321,9 @@ envy24ht_p32sl(struct sc_chinfo *ch)
 	length = sndbuf_getready(ch->buffer) / 8;
 	dmabuf = ch->parent->pbuf;
 	data = (u_int32_t *)ch->data;
 	src = sndbuf_getreadyptr(ch->buffer) / 4;
-	dst = src / 2 + ch->offset;
+	src -= src % 2;
+	dst = (src / 2 + ch->offset) % (ch->size / 8);
 	ssize = ch->size / 4;
 	dsize = ch->size / 8;
 	slot = ch->num * 2;
@@ -1354,7 +1356,9 @@ envy24ht_p16sl(struct sc_chinfo *ch)
 	length = sndbuf_getready(ch->buffer) / 4;
 	dmabuf = ch->parent->pbuf;
 	data = (u_int16_t *)ch->data;
 	src = sndbuf_getreadyptr(ch->buffer) / 2;
-	dst = src / 2 + ch->offset;
+	src -= src % 2;
+	dst = (src / 2 + ch->offset) % (ch->size / 4);
 	ssize = ch->size / 2;
 	dsize = ch->size / 4;
 	slot = ch->num * 2;
@@ -1396,7 +1400,9 @@ envy24ht_p8u(struct sc_chinfo *ch)
 	length = sndbuf_getready(ch->buffer) / 2;
 	dmabuf = ch->parent->pbuf;
 	data = (u_int8_t *)ch->data;
 	src = sndbuf_getreadyptr(ch->buffer);
-	dst = src / 2 + ch->offset;
+	src -= src % 2;
+	dst = (src / 2 + ch->offset) % (ch->size / 4);
 	ssize = ch->size;
 	dsize = ch->size / 4;
 	slot = ch->num * 2;
@@ -1426,7 +1432,9 @@ envy24ht_r32sl(struct sc_chinfo *ch)
 	length = sndbuf_getfree(ch->buffer) / 8;
 	dmabuf = ch->parent->rbuf;
 	data = (u_int32_t *)ch->data;
 	dst = sndbuf_getfreeptr(ch->buffer) / 4;
-	src = dst / 2 + ch->offset;
+	dst -= dst % 2;
+	src = (dst / 2 + ch->offset) % (ch->size / 8);
 	dsize = ch->size / 4;
 	ssize = ch->size / 8;
 	slot = (ch->num - ENVY24HT_CHAN_REC_ADC1) * 2;
@@ -1456,7 +1464,9 @@ envy24ht_r16sl(struct sc_chinfo *ch)
 	length = sndbuf_getfree(ch->buffer) / 4;
 	dmabuf = ch->parent->rbuf;
 	data = (u_int16_t *)ch->data;
 	dst = sndbuf_getfreeptr(ch->buffer) / 2;
-	src = dst / 2 + ch->offset;
+	dst -= dst % 2;
+	src = (dst / 2 + ch->offset) % (ch->size / 8);
 	dsize = ch->size / 2;
 	ssize = ch->size / 8;
 	slot = (ch->num - ENVY24HT_CHAN_REC_ADC1) * 2;