From f4d770317997f89bb6997ee3e8dd495cb8356ae9 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 17 Apr 2015 16:19:46 +0300 Subject: ALSA: hda - potential (but unlikely) uninitialized variable This function is a bit unusual because it accepts negative values as "conn_len". It's theoretically possible for both "cache_len" and "conn_len" to be -ENOSPC and in that case we would oops trying to run memcmp() on the uninitialized "list" pointer. Signed-off-by: Dan Carpenter Signed-off-by: Takashi Iwai --- sound/pci/hda/hda_proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sound') diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c index ee6230767c64..baaf7ed06875 100644 --- a/sound/pci/hda/hda_proc.c +++ b/sound/pci/hda/hda_proc.c @@ -582,8 +582,8 @@ static void print_conn_list(struct snd_info_buffer *buffer, /* Get Cache connections info */ cache_len = snd_hda_get_conn_list(codec, nid, &list); - if (cache_len != conn_len - || memcmp(list, conn, conn_len)) { + if (cache_len >= 0 && (cache_len != conn_len || + memcmp(list, conn, conn_len) != 0)) { snd_iprintf(buffer, " In-driver Connection: %d\n", cache_len); if (cache_len > 0) { snd_iprintf(buffer, " "); -- cgit v1.2.3