diff options
| author | Roel Kluin <roel.kluin@gmail.com> | 2009-07-29 16:35:20 +0400 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2009-07-29 16:35:20 +0400 |
| commit | 78735cffc2d9ab0dec32f1ba7cbc1d84b45bbf29 (patch) | |
| tree | e12a32a8d7735e2ef0926d6d4f812e1d5dd155fc | |
| parent | 626f5cefc60b281a00db1402b82deff82080c70a (diff) | |
| download | linux-78735cffc2d9ab0dec32f1ba7cbc1d84b45bbf29.tar.xz | |
ALSA: hda: fix out-of-bound hdmi_eld.sad[] write
e->sad[] is declared with size ELD_MAX_SAD=16, but the guard
allows range 0-31.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/pci/hda/hda_eld.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c index fcad5ec31773..9446a5abea13 100644 --- a/sound/pci/hda/hda_eld.c +++ b/sound/pci/hda/hda_eld.c @@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, char name[64]; char *sname; long long val; - int n; + unsigned int n; while (!snd_info_get_line(buffer, line, sizeof(line))) { if (sscanf(line, "%s %llx", name, &val) != 2) @@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, sname++; n = 10 * n + name[4] - '0'; } - if (n < 0 || n > 31) /* double the CEA limit */ + if (n >= ELD_MAX_SAD) continue; if (!strcmp(sname, "_coding_type")) e->sad[n].format = val; |