diff options
| author | Takashi Iwai <tiwai@suse.de> | 2024-08-08 11:14:42 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2024-08-08 11:15:55 +0200 |
| commit | 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 (patch) | |
| tree | c0b052b9ec4283a426e0d0859eed359858098ad0 /sound/pci/asihpi/hpimsgx.c | |
| parent | ALSA: core: Drop snd_print stuff and co (diff) | |
| download | linux-7b986c7430a6bb68d523dac7bfc74cbd5b44ef96.tar.xz linux-7b986c7430a6bb68d523dac7bfc74cbd5b44ef96.zip | |
ALSA: asihpi: Fix potential OOB array access
ASIHPI driver stores some values in the static array upon a response
from the driver, and its index depends on the firmware. We shouldn't
trust it blindly.
This patch adds a sanity check of the array index to fit in the array
size.
Link: https://patch.msgid.link/20240808091454.30846-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to '')
| -rw-r--r-- | sound/pci/asihpi/hpimsgx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c index d0caef299481..b68e6bfbbfba 100644 --- a/sound/pci/asihpi/hpimsgx.c +++ b/sound/pci/asihpi/hpimsgx.c @@ -708,7 +708,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error = HPI_ERROR_PROCESSING_MESSAGE; return phr->error; } - if (hr.error == 0) { + if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) { /* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func; |