Skip to content

Commit 98e5eb1

Browse files
morimototiwai
authored andcommitted
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i < TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case. Signed-off-by: Kuninori Morimoto <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Takashi Iwai <[email protected]>
1 parent 9026c0b commit 98e5eb1

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

sound/pci/hda/patch_ca0132.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4228,8 +4228,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid,
42284228

42294229
for (i = 0; i < TUNING_CTLS_COUNT; i++)
42304230
if (nid == ca0132_tuning_ctls[i].nid)
4231-
break;
4231+
goto found;
42324232

4233+
return -EINVAL;
4234+
found:
42334235
snd_hda_power_up(codec);
42344236
dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
42354237
ca0132_tuning_ctls[i].req,

0 commit comments

Comments
 (0)