leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ALSA: usb-audio - Fix possible access over audio_feature_info[] array

Browse Source 
The audio_feature_info[] array should contain all entries for UAC2_FU_*,
but currently a few last entries are missing.  Even though, the driver
tries to probe these entries in parse_audio_feature_unit() and may
access the range over the array.  This patch fixes the bug by limiting
the loop size properly using ARRAY_SIZE() instead of a hard-coded
magic number.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2011-10-13 08:19:09 +02:00
parent e653510a27
commit d09c06c6fc
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/usb/mixer.c
View File

@ -1259,7 +1259,7 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
build_feature_ctl(state, _ftr, 0, i, &iterm, unitid, 0);
}
} else { /* UAC_VERSION_2 */
for (i = 0; i < 30/2; i++) {
for (i = 0; i < ARRAY_SIZE(audio_feature_info); i++) {
unsigned int ch_bits = 0;
unsigned int ch_read_only = 0;