summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-11-10 22:11:55 +0300
committerTakashi Iwai <tiwai@suse.de>2009-11-11 10:07:05 +0300
commit71121d9fcc494453b9311992de220abb47dde3f1 (patch)
tree206f27537829d91f92cd80a0394ba3a77c3d7519 /sound
parent4ac55982907e1d48e64feaa56be91b9b52d3714d (diff)
downloadlinux-71121d9fcc494453b9311992de220abb47dde3f1.tar.xz
ALSA: hda - possible read past array alc88[02]_parse_auto_config()
The test of index `i' is after the read - too late - and unsafe: if snd_hda_get_connections() fails in the last iteration a read beyond the array is possible. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r--sound/pci/hda/patch_realtek.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d1ccb6eaf9fc..daf6975b0c2e 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4684,9 +4684,9 @@ static int alc880_parse_auto_config(struct hda_codec *codec)
spec->multiout.dig_out_nid = dig_nid;
else {
spec->multiout.slave_dig_outs = spec->slave_dig_outs;
- spec->slave_dig_outs[i - 1] = dig_nid;
- if (i == ARRAY_SIZE(spec->slave_dig_outs) - 1)
+ if (i >= ARRAY_SIZE(spec->slave_dig_outs) - 1)
break;
+ spec->slave_dig_outs[i - 1] = dig_nid;
}
}
if (spec->autocfg.dig_in_pin)
@@ -9813,9 +9813,9 @@ static int alc882_parse_auto_config(struct hda_codec *codec)
spec->multiout.dig_out_nid = dig_nid;
else {
spec->multiout.slave_dig_outs = spec->slave_dig_outs;
- spec->slave_dig_outs[i - 1] = dig_nid;
- if (i == ARRAY_SIZE(spec->slave_dig_outs) - 1)
+ if (i >= ARRAY_SIZE(spec->slave_dig_outs) - 1)
break;
+ spec->slave_dig_outs[i - 1] = dig_nid;
}
}
if (spec->autocfg.dig_in_pin)