diff options
| author | Takashi Iwai <tiwai@suse.de> | 2011-10-13 08:19:09 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2011-10-13 08:19:09 +0200 |
| commit | d09c06c6fc240261dde65198774b279d89c35459 (patch) | |
| tree | efd2c6881892a6b0ced0b29743a85d814721af17 /sound/usb | |
| parent | e653510a27e63b41a5bae3c46eb093375e17ca2d (diff) | |
| download | op-kernel-dev-d09c06c6fc240261dde65198774b279d89c35459.zip op-kernel-dev-d09c06c6fc240261dde65198774b279d89c35459.tar.gz | |
ALSA: usb-audio - Fix possible access over audio_feature_info[] array
The audio_feature_info[] array should contain all entries for UAC2_FU_*,
but currently a few last entries are missing. Even though, the driver
tries to probe these entries in parse_audio_feature_unit() and may
access the range over the array. This patch fixes the bug by limiting
the loop size properly using ARRAY_SIZE() instead of a hard-coded
magic number.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb')
| -rw-r--r-- | sound/usb/mixer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index b13b7ac..60f65ac 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1259,7 +1259,7 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void build_feature_ctl(state, _ftr, 0, i, &iterm, unitid, 0); } } else { /* UAC_VERSION_2 */ - for (i = 0; i < 30/2; i++) { + for (i = 0; i < ARRAY_SIZE(audio_feature_info); i++) { unsigned int ch_bits = 0; unsigned int ch_read_only = 0; |
