From d09c06c6fc240261dde65198774b279d89c35459 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Thu, 13 Oct 2011 08:19:09 +0200 Subject: ALSA: usb-audio - Fix possible access over audio_feature_info[] array The audio_feature_info[] array should contain all entries for UAC2_FU_*, but currently a few last entries are missing. Even though, the driver tries to probe these entries in parse_audio_feature_unit() and may access the range over the array. This patch fixes the bug by limiting the loop size properly using ARRAY_SIZE() instead of a hard-coded magic number. Reported-by: Dan Carpenter Signed-off-by: Takashi Iwai --- sound/usb/mixer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sound/usb/mixer.c') diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index b13b7ac..60f65ac 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1259,7 +1259,7 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void build_feature_ctl(state, _ftr, 0, i, &iterm, unitid, 0); } } else { /* UAC_VERSION_2 */ - for (i = 0; i < 30/2; i++) { + for (i = 0; i < ARRAY_SIZE(audio_feature_info); i++) { unsigned int ch_bits = 0; unsigned int ch_read_only = 0; -- cgit v1.1