diff options
| author | Takashi Iwai <tiwai@suse.de> | 2024-08-08 12:14:42 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-10-10 12:57:30 +0300 |
| commit | 7a55740996701f7b2bc46dc988b60ef2e416a747 (patch) | |
| tree | 0b9c23adbb8e8d41db3a0d6c70ce2baf1caa453f | |
| parent | ddd52c9fe992a73d3948178a2dc1835363559908 (diff) | |
| download | linux-7a55740996701f7b2bc46dc988b60ef2e416a747.tar.xz | |
ALSA: asihpi: Fix potential OOB array access
[ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ]
ASIHPI driver stores some values in the static array upon a response
from the driver, and its index depends on the firmware. We shouldn't
trust it blindly.
This patch adds a sanity check of the array index to fit in the array
size.
Link: https://patch.msgid.link/20240808091454.30846-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | sound/pci/asihpi/hpimsgx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c index d0caef299481..b68e6bfbbfba 100644 --- a/sound/pci/asihpi/hpimsgx.c +++ b/sound/pci/asihpi/hpimsgx.c @@ -708,7 +708,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error = HPI_ERROR_PROCESSING_MESSAGE; return phr->error; } - if (hr.error == 0) { + if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) { /* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func; |