Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

[linux-2.6-microblaze.git] / sound / soc / soc-topology.c

diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index eb2633d..950c450 100644 (file)
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -856,6 +856,9 @@ static int soc_tplg_denum_create_texts(struct soc_tplg *tplg, struct soc_enum *s
 {
        int i, ret;
 
+       if (le32_to_cpu(ec->items) > ARRAY_SIZE(ec->texts))
+               return -EINVAL;
+
        se->dobj.control.dtexts =
                devm_kcalloc(tplg->dev, le32_to_cpu(ec->items), sizeof(char *), GFP_KERNEL);
        if (se->dobj.control.dtexts == NULL)
@@ -889,10 +892,16 @@ static int soc_tplg_denum_create_values(struct soc_tplg *tplg, struct soc_enum *
 {
        int i;
 
-       if (le32_to_cpu(ec->items) > sizeof(*ec->values))
+       /*
+        * Following "if" checks if we have at most SND_SOC_TPLG_NUM_TEXTS
+        * values instead of using ARRAY_SIZE(ec->values) due to the fact that
+        * it is oversized for its purpose. Additionally it is done so because
+        * it is defined in UAPI header where it can't be easily changed.
+        */
+       if (le32_to_cpu(ec->items) > SND_SOC_TPLG_NUM_TEXTS)
                return -EINVAL;
 
-       se->dobj.control.dvalues = devm_kzalloc(tplg->dev, le32_to_cpu(ec->items) *
+       se->dobj.control.dvalues = devm_kcalloc(tplg->dev, le32_to_cpu(ec->items),
                                           sizeof(u32),
                                           GFP_KERNEL);
        if (!se->dobj.control.dvalues)