summaryrefslogtreecommitdiffstats
path: root/sound/oss/dev_table.c
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-01-03 12:39:27 +0100
committerJaroslav Kysela <perex@perex.cz>2010-01-08 09:17:51 +0100
commit444c1953d496d272208902ff7010dc70d1f887f0 (patch)
tree40aa1e10f108818b3b7d12384229c0501aeb5a12 /sound/oss/dev_table.c
parent440b004cf953bec2bc8cd91c64ae707fd7e25327 (diff)
downloadop-kernel-dev-444c1953d496d272208902ff7010dc70d1f887f0.zip
op-kernel-dev-444c1953d496d272208902ff7010dc70d1f887f0.tar.gz
sound: oss: off by one bug
The problem is that in the original code sound_nblocks could go up to 1024 which would be an array overflow. This was found with a static checker and has been compile tested only. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound/oss/dev_table.c')
-rw-r--r--sound/oss/dev_table.c16
1 files changed, 9 insertions, 7 deletions
diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c
index 08274c9..727bdb9 100644
--- a/sound/oss/dev_table.c
+++ b/sound/oss/dev_table.c
@@ -67,14 +67,15 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver,
return -(EBUSY);
}
d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver)));
-
- if (sound_nblocks < 1024)
- sound_nblocks++;
+ sound_nblocks++;
+ if (sound_nblocks >= MAX_MEM_BLOCKS)
+ sound_nblocks = MAX_MEM_BLOCKS - 1;
op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations)));
+ sound_nblocks++;
+ if (sound_nblocks >= MAX_MEM_BLOCKS)
+ sound_nblocks = MAX_MEM_BLOCKS - 1;
- if (sound_nblocks < 1024)
- sound_nblocks++;
if (d == NULL || op == NULL) {
printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name);
sound_unload_audiodev(num);
@@ -128,9 +129,10 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver,
until you unload sound! */
op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations)));
+ sound_nblocks++;
+ if (sound_nblocks >= MAX_MEM_BLOCKS)
+ sound_nblocks = MAX_MEM_BLOCKS - 1;
- if (sound_nblocks < 1024)
- sound_nblocks++;
if (op == NULL) {
printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name);
return -ENOMEM;
OpenPOWER on IntegriCloud