CVE request: kernel: two OSS fixes

[Dan Rosenberg <dan.j.rosenberg () gmail com>]

For both issues, access to /dev/sequencer is required, which is
typically reserved for group audio.  Additionally, these only affect
systems that use OSS (not to be confused with the OSS emulation layer
provided by ALSA).

1. Specially crafted requests may be written to /dev/sequencer
resulting in an underflow when calculating a size for a
copy_from_user() operation in the driver for MIDI interfaces.  On x86,
this just returns an error, but it may cause memory corruption on
other architectures.  Other malformed requests may result in the use
of uninitialized variables.  [1]

2. Due to a failure to validate user-supplied indexes in the driver
for Yamaha YM3812 and OPL-3 chips, a specially crafted ioctl request
may be sent to /dev/sequencer, resulting in reading and writing beyond
the bounds of heap buffers, and potentially allowing privilege
escalation.  [2]

[1] http://marc.info/?l=linux-kernel&m=130089204124354&w=2
[2] http://marc.info/?l=linux-kernel&m=130089499728386&w=2