tag c030847f1276e396a6eaebc5aa13544b46beaef3
tagger The Android Open Source Project <initial-contribution@android.com> Wed Aug 24 15:45:58 2016 -0700
object 9ea08eae1252c50831e85f8083eae2aa64ddf3e4

Android Lego 6.0.1 Release 0.6

commit 9ea08eae1252c50831e85f8083eae2aa64ddf3e4
author Akhila musunuri <makhila@codeaurora.org> Wed Jul 16 09:37:04 2014 +0300
committer Akhila musunuri <makhila@codeaurora.org> Tue Jul 19 16:12:38 2016 +0530
tree 2f6582ce547e05a008899bd651b7dec5c32f5c42
parent 7c6006ed554725719b134c8476a565acb7587344

ALSA: compress: fix an integer overflow check

I previously added an integer overflow check here but looking at it now,
it's still buggy.

The bug happens in snd_compr_allocate_buffer().  We multiply
".fragments" and ".fragment_size" and that doesn't overflow but then we
save it in an unsigned int so it truncates the high bits away and we
allocate a smaller than expected size.

Change-Id: Ifaeca85636bee6d5587009170d0539b31fe9b340
Fixes: b35cc8225845 ('ALSA: compress_core: integer overflow in snd_compr_allocate_buffer()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Git-commit: 6217e5ede23285ddfee10d2e4ba0cc2d4c046205
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>