aboutsummaryrefslogtreecommitdiffstats
path: root/sound
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-07-29 08:35:20 -0400
committerTakashi Iwai <tiwai@suse.de>2009-07-29 08:35:20 -0400
commit78735cffc2d9ab0dec32f1ba7cbc1d84b45bbf29 (patch)
treee12a32a8d7735e2ef0926d6d4f812e1d5dd155fc /sound
parent626f5cefc60b281a00db1402b82deff82080c70a (diff)
ALSA: hda: fix out-of-bound hdmi_eld.sad[] write
e->sad[] is declared with size ELD_MAX_SAD=16, but the guard allows range 0-31. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Wu Fengguang <fengguang.wu@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r--sound/pci/hda/hda_eld.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index fcad5ec31773..9446a5abea13 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
508 char name[64]; 508 char name[64];
509 char *sname; 509 char *sname;
510 long long val; 510 long long val;
511 int n; 511 unsigned int n;
512 512
513 while (!snd_info_get_line(buffer, line, sizeof(line))) { 513 while (!snd_info_get_line(buffer, line, sizeof(line))) {
514 if (sscanf(line, "%s %llx", name, &val) != 2) 514 if (sscanf(line, "%s %llx", name, &val) != 2)
@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
539 sname++; 539 sname++;
540 n = 10 * n + name[4] - '0'; 540 n = 10 * n + name[4] - '0';
541 } 541 }
542 if (n < 0 || n > 31) /* double the CEA limit */ 542 if (n >= ELD_MAX_SAD)
543 continue; 543 continue;
544 if (!strcmp(sname, "_coding_type")) 544 if (!strcmp(sname, "_coding_type"))
545 e->sad[n].format = val; 545 e->sad[n].format = val;