From 6123637fafbf445cc9ce5774dc9516da0b2daa88 Mon Sep 17 00:00:00 2001 From: Clemens Ladisch Date: Mon, 1 Feb 2010 13:30:56 +0100 Subject: sound: control: fix minimum TLV length Allow TLV blocks that do not have any values; the smallest possible TLV is an empty container or one where the information is only in the tag. Signed-off-by: Clemens Ladisch Signed-off-by: Jaroslav Kysela diff --git a/sound/core/control.c b/sound/core/control.c index 6a4764d..439ce64 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1100,7 +1100,7 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, if (copy_from_user(&tlv, _tlv, sizeof(tlv))) return -EFAULT; - if (tlv.length < sizeof(unsigned int) * 3) + if (tlv.length < sizeof(unsigned int) * 2) return -EINVAL; down_read(&card->controls_rwsem); kctl = snd_ctl_find_numid(card, tlv.numid); -- cgit v0.10.2