Skip to content

Commit

Permalink
ALSA: usb-audio: US16x08: Move overflow check before array access
Browse files Browse the repository at this point in the history
Buffer overflow could occur in the loop "while", due to accessing an
array element before checking the index.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Daniil Dementev <d.dementev@ispras.ru>
Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Link: https://lore.kernel.org/r/20220610165732.2904-1-d.dementev@ispras.ru
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Daniil Dementev authored and Takashi Iwai committed Jun 13, 2022
1 parent b2e6b3d commit 3ddbe35
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions sound/usb/mixer_us16x08.c
Original file line number Diff line number Diff line change
Expand Up @@ -637,10 +637,10 @@ static int snd_get_meter_comp_index(struct snd_us16x08_meter_store *store)
}
} else {
/* skip channels with no compressor active */
while (!store->comp_store->val[
while (store->comp_index <= SND_US16X08_MAX_CHANNELS
&& !store->comp_store->val[
COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)]
[store->comp_index - 1]
&& store->comp_index <= SND_US16X08_MAX_CHANNELS) {
[store->comp_index - 1]) {
store->comp_index++;
}
ret = store->comp_index++;
Expand Down

0 comments on commit 3ddbe35

Please sign in to comment.