Commit 78735cff authored by Roel Kluin's avatar Roel Kluin Committed by Takashi Iwai

ALSA: hda: fix out-of-bound hdmi_eld.sad[] write

e->sad[] is declared with size ELD_MAX_SAD=16, but the guard
allows range 0-31.
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarWu Fengguang <fengguang.wu@intel.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 626f5cef
...@@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, ...@@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
char name[64]; char name[64];
char *sname; char *sname;
long long val; long long val;
int n; unsigned int n;
while (!snd_info_get_line(buffer, line, sizeof(line))) { while (!snd_info_get_line(buffer, line, sizeof(line))) {
if (sscanf(line, "%s %llx", name, &val) != 2) if (sscanf(line, "%s %llx", name, &val) != 2)
...@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, ...@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
sname++; sname++;
n = 10 * n + name[4] - '0'; n = 10 * n + name[4] - '0';
} }
if (n < 0 || n > 31) /* double the CEA limit */ if (n >= ELD_MAX_SAD)
continue; continue;
if (!strcmp(sname, "_coding_type")) if (!strcmp(sname, "_coding_type"))
e->sad[n].format = val; e->sad[n].format = val;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment