diff options
author | Jesper Juhl <jj@chaosbits.net> | 2011-01-20 16:37:43 -0500 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2011-01-22 11:24:30 -0500 |
commit | 233d84c46c2253d13e10b42d88c14748fbb67a98 (patch) | |
tree | f1d0fed8209eaf4bf205440454db92f86d066349 /sound | |
parent | 842a2097007b8a01a71a701300e970502a54bbb2 (diff) |
ALSA: Xonar, CS43xx: Don't overrun static array
'cs4398_regs' in 'struct xonar_cs43xx' is an array of 'u8' with a size of
8. So, this code in sound/pci/oxygen/xonar_cs43xx.c::dump_d1_registers()
for (i = 2; i <= 8; ++i)
snd_iprintf(buffer, " %02x", data->cs4398_regs[i]);
will overrun the array when 'i == 8'.
I guess that what's needed to fix it is the trivial patch below, but I
must admit that I have no idea about this code, so I may very well be
wrong. Additionally, I have no way to actually test this, so all I know is
that the below compiles. Someone who actually knows this code should take
a look before anything is comitted - consider the below (not much more
than) a bug report.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Clemens Ladisch <clemens@ladisch.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r-- | sound/pci/oxygen/xonar_cs43xx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c index 9f72d424969c..252719101c42 100644 --- a/sound/pci/oxygen/xonar_cs43xx.c +++ b/sound/pci/oxygen/xonar_cs43xx.c | |||
@@ -392,7 +392,7 @@ static void dump_d1_registers(struct oxygen *chip, | |||
392 | unsigned int i; | 392 | unsigned int i; |
393 | 393 | ||
394 | snd_iprintf(buffer, "\nCS4398: 7?"); | 394 | snd_iprintf(buffer, "\nCS4398: 7?"); |
395 | for (i = 2; i <= 8; ++i) | 395 | for (i = 2; i < 8; ++i) |
396 | snd_iprintf(buffer, " %02x", data->cs4398_regs[i]); | 396 | snd_iprintf(buffer, " %02x", data->cs4398_regs[i]); |
397 | snd_iprintf(buffer, "\n"); | 397 | snd_iprintf(buffer, "\n"); |
398 | dump_cs4362a_registers(data, buffer); | 398 | dump_cs4362a_registers(data, buffer); |