sound: oss: off by one bug

The problem is that in the original code sound_nblocks could go up to 1024
which would be an array overflow.

This was found with a static checker and has been compile tested only.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

1 files changed, 9 insertions, 7 deletions

diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c
index 08274c995d06..727bdb9ba2dc 100644
--- a/sound/oss/dev_table.c
+++ b/sound/oss/dev_table.c
@@ -67,14 +67,15 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver,
                 return -(EBUSY);
         }
         d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver)));
-
-        if (sound_nblocks < 1024)
-                sound_nblocks++;
+        sound_nblocks++;
+        if (sound_nblocks >= MAX_MEM_BLOCKS)
+                sound_nblocks = MAX_MEM_BLOCKS - 1;
 
         op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations)));
+        sound_nblocks++;
+        if (sound_nblocks >= MAX_MEM_BLOCKS)
+                sound_nblocks = MAX_MEM_BLOCKS - 1;
 
-        if (sound_nblocks < 1024)
-                sound_nblocks++;
         if (d == NULL || op == NULL) {
                 printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name);
                 sound_unload_audiodev(num);
@@ -128,9 +129,10 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver,
            until you unload sound! */
            
         op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations)));
+        sound_nblocks++;
+        if (sound_nblocks >= MAX_MEM_BLOCKS)
+                sound_nblocks = MAX_MEM_BLOCKS - 1;
 
-        if (sound_nblocks < 1024)
-                sound_nblocks++;
         if (op == NULL) {
                 printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name);
                 return -ENOMEM;