--- sound/oss/midi_synth.c

+++ sound/oss/midi_synth.c

@@ -476,7 +476,7 @@ EXPORT_SYMBOL(midi_synth_hw_control);

int

midi_synth_load_patch(int dev, int format, const char __user *addr,

- int offs, int count, int pmgr_flag)

+ int count, int pmgr_flag)

{

int orig_dev = synth_devs[dev]->midi_dev;

@@ -491,39 +491,37 @@ midi_synth_load_patch(int dev, int forma

if (!prefix_cmd(orig_dev, 0xf0))

return 0;

+ /* Invalid patch format */

if (format != SYSEX_PATCH)

- {

-/* printk("MIDI Error: Invalid patch format (key) 0x%x\n", format);*/

return -EINVAL;

- }

+

+ /* Patch header too short */

if (count < hdr_size)

- {

-/* printk("MIDI Error: Patch header too short\n");*/

return -EINVAL;

- }

+

count -= hdr_size;

/*

- * Copy the header from user space but ignore the first bytes which have

- * been transferred already.

+ * Copy the header from user space

*/

- if(copy_from_user(&((char *) &sysex)[offs], &(addr)[offs], hdr_size - offs))

+ if (copy_from_user(&sysex, addr, hdr_size))

return -EFAULT;

-

- if (count < sysex.len)

- {

-/* printk(KERN_WARNING "MIDI Warning: Sysex record too short (%d<%d)\n", count, (int) sysex.len);*/

+

+ /* Sysex record too short */

+ if ((unsigned)count < (unsigned)sysex.len)

sysex.len = count;

- }

- left = sysex.len;

- src_offs = 0;

+

+ left = sysex.len;

+ src_offs = 0;

for (i = 0; i < left && !signal_pending(current); i++)

{

unsigned char data;

- get_user(*(unsigned char *) &data, (unsigned char __user *) &((addr)[hdr_size + i]));

+ if (get_user(data,

+ (unsigned char __user *)(addr + hdr_size + i)))

+ return -EFAULT;

eox_seen = (i > 0 && data & 0x80); /* End of sysex */