diff options
author | Alexander Stein <alexander.stein@systec-electronic.com> | 2011-11-01 04:40:07 -0400 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2011-11-01 04:46:39 -0400 |
commit | 359f90982cba0ba8db39b683de05dcb2de64b979 (patch) | |
tree | 16c4a21f9968f3a5e84f0d274244861f7f173903 /sound | |
parent | 228cf79376f13b98f2e1ac10586311312757675c (diff) |
ALSA: hda_hwdep: Fix possible buffer overflow
If a line in the firmware file is larger than the given buffer size (and
so the firmware file size), size is set to a value larger than the actual
buffer size. This results in an overflow in the buffer passed.
Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r-- | sound/pci/hda/hda_hwdep.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c index 72e5885007cc..7e7d0788ddcf 100644 --- a/sound/pci/hda/hda_hwdep.c +++ b/sound/pci/hda/hda_hwdep.c | |||
@@ -756,8 +756,6 @@ static int get_line_from_fw(char *buf, int size, struct firmware *fw) | |||
756 | } | 756 | } |
757 | if (!fw->size) | 757 | if (!fw->size) |
758 | return 0; | 758 | return 0; |
759 | if (size < fw->size) | ||
760 | size = fw->size; | ||
761 | 759 | ||
762 | for (len = 0; len < fw->size; len++) { | 760 | for (len = 0; len < fw->size; len++) { |
763 | if (!*p) | 761 | if (!*p) |