diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-01-03 12:39:27 +0100 |
|---|---|---|
| committer | Jaroslav Kysela <perex@perex.cz> | 2010-01-08 09:17:51 +0100 |
| commit | 444c1953d496d272208902ff7010dc70d1f887f0 (patch) | |
| tree | 40aa1e10f108818b3b7d12384229c0501aeb5a12 /sound/oss/dev_table.c | |
| parent | ALSA: hda/realtek: Remove extra .capsrc_nids initialization for ALC889_INTEL (diff) | |
| download | linux-444c1953d496d272208902ff7010dc70d1f887f0.tar.xz linux-444c1953d496d272208902ff7010dc70d1f887f0.zip | |
sound: oss: off by one bug
The problem is that in the original code sound_nblocks could go up to 1024
which would be an array overflow.
This was found with a static checker and has been compile tested only.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Diffstat (limited to 'sound/oss/dev_table.c')
| -rw-r--r-- | sound/oss/dev_table.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c index 08274c995d06..727bdb9ba2dc 100644 --- a/sound/oss/dev_table.c +++ b/sound/oss/dev_table.c @@ -67,14 +67,15 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver, return -(EBUSY); } d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver))); - - if (sound_nblocks < 1024) - sound_nblocks++; + sound_nblocks++; + if (sound_nblocks >= MAX_MEM_BLOCKS) + sound_nblocks = MAX_MEM_BLOCKS - 1; op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations))); + sound_nblocks++; + if (sound_nblocks >= MAX_MEM_BLOCKS) + sound_nblocks = MAX_MEM_BLOCKS - 1; - if (sound_nblocks < 1024) - sound_nblocks++; if (d == NULL || op == NULL) { printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name); sound_unload_audiodev(num); @@ -128,9 +129,10 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver, until you unload sound! */ op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations))); + sound_nblocks++; + if (sound_nblocks >= MAX_MEM_BLOCKS) + sound_nblocks = MAX_MEM_BLOCKS - 1; - if (sound_nblocks < 1024) - sound_nblocks++; if (op == NULL) { printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name); return -ENOMEM; |