linux-kernel - sound/pci/hda/patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071019125709.GZ3778@stusta.de>
Date:	Fri, 19 Oct 2007 14:57:09 +0200
From:	Adrian Bunk <bunk@...nel.org>
To:	perex@...ex.cz
Cc:	linux-kernel@...r.kernel.org
Subject: sound/pci/hda/patch_via.c: array overflow

sound/pci/hda/patch_via.c contains the following code:

<--  snip  -->

...
struct via_spec {
...
        hda_nid_t private_dac_nids[4];  
...                               ^^^
};
...
static int vt1709_auto_fill_dac_nids(struct via_spec *spec,
                                     const struct auto_pin_cfg *cfg)
{
...
       spec->multiout.dac_nids = spec->private_dac_nids;

        if (cfg->line_outs == 4) { /* 10 channels */   <------------------
                for (i = 0; i < cfg->line_outs; i++) {
                        nid = cfg->line_out_pins[i];
                        if (nid) {
                                /* config dac list */
                                switch (i) {
                                case AUTO_SEQ_FRONT:
                                        /* AOW0 */
                                        spec->multiout.dac_nids[i] = 0x10;
                                        break;
                                case AUTO_SEQ_CENLFE:
                                        /* AOW2 */
                                        spec->multiout.dac_nids[i] = 0x12;
                                        break;
                                case AUTO_SEQ_SURROUND:
                                        /* AOW3 */
                                        spec->multiout.dac_nids[i] = 0x27;
                                        break;
                                case AUTO_SEQ_SIDE:
                                        /* AOW1 */
                                        spec->multiout.dac_nids[i] = 0x11;
                                        break;
                                default:
                                        break;
                                }
                        }
                }
                spec->multiout.dac_nids[cfg->line_outs] = 0x28; /* AOW4 */
...                                     ^^^^^^^^^^^^^^

<--  snip  -->

Spotted by the Coverity checker.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/