diff options
| author | Volker Rümelin <vr_qemu@t-online.de> | 2024-08-02 09:18:05 +0200 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2024-08-20 06:57:47 -0400 |
| commit | 7d14471a121878602cb4e748c4707f9ab9a9e3e2 (patch) | |
| tree | 94dbd84744c202022771ce41f74c16eee223f29b | |
| parent | f8e09b973ae8489b88394bff0118d19f989bf277 (diff) | |
| download | qemu-7d14471a121878602cb4e748c4707f9ab9a9e3e2.zip qemu-7d14471a121878602cb4e748c4707f9ab9a9e3e2.tar.gz qemu-7d14471a121878602cb4e748c4707f9ab9a9e3e2.tar.bz2 | |
hw/audio/virtio-snd: fix invalid param check
Commit 9b6083465f ("virtio-snd: check for invalid param shift
operands") tries to prevent invalid parameters specified by the
guest. However, the code is not correct.
Change the code so that the parameters format and rate, which are
a bit numbers, are compared with the bit size of the data type.
Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands")
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| -rw-r--r-- | hw/audio/virtio-snd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index e5196aa..d1cf5eb 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -282,12 +282,12 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s, error_report("Number of channels is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); } - if (BIT(params->format) > sizeof(supported_formats) || + if (params->format >= sizeof(supported_formats) * BITS_PER_BYTE || !(supported_formats & BIT(params->format))) { error_report("Stream format is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); } - if (BIT(params->rate) > sizeof(supported_rates) || + if (params->rate >= sizeof(supported_rates) * BITS_PER_BYTE || !(supported_rates & BIT(params->rate))) { error_report("Stream rate is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); |