mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-15 23:25:07 +00:00
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
[ Upstream commit 98e5eb1100
]
tuning_ctl_set() might have buffer overrun at (X) if it didn't break
from loop by matching (A).
static int tuning_ctl_set(...)
{
for (i = 0; i < TUNING_CTLS_COUNT; i++)
(A) if (nid == ca0132_tuning_ctls[i].nid)
break;
snd_hda_power_up(...);
(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
snd_hda_power_down(...); ^
return 1;
}
We will get below error by cppcheck
sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
for (i = 0; i < TUNING_CTLS_COUNT; i++)
^
sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
^
This patch cares non match case.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
fcf80111a4
commit
baef27176e
1 changed files with 3 additions and 1 deletions
|
@ -4108,8 +4108,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid,
|
|||
|
||||
for (i = 0; i < TUNING_CTLS_COUNT; i++)
|
||||
if (nid == ca0132_tuning_ctls[i].nid)
|
||||
break;
|
||||
goto found;
|
||||
|
||||
return -EINVAL;
|
||||
found:
|
||||
snd_hda_power_up(codec);
|
||||
dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
|
||||
ca0132_tuning_ctls[i].req,
|
||||
|
|
Loading…
Reference in a new issue