Skip to content

Commit

Permalink
ALSA: asihpi - off by one in asihpi_hpi_ioctl()
Browse files Browse the repository at this point in the history
"adapter" is used as an array index in the adapters[] array so
the off by one would make us read past the end.

1c073b6 "ALSA: asihpi - Remove spurious adapter index check"
reverted Dan Rosenberg's check that would have prevented the
overflow here.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Dan Carpenter authored and Takashi Iwai committed Jul 27, 2011
1 parent 60a6a84 commit ae6ff61
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion sound/pci/asihpi/hpioctl.c
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
u32 adapter = hm->h.adapter_index;
struct hpi_adapter *pa = &adapters[adapter];

if ((adapter > HPI_MAX_ADAPTERS) || (!pa->type)) {
if ((adapter >= HPI_MAX_ADAPTERS) || (!pa->type)) {
hpi_init_response(&hr->r0, HPI_OBJ_ADAPTER,
HPI_ADAPTER_OPEN,
HPI_ERROR_BAD_ADAPTER_NUMBER);
Expand Down

0 comments on commit ae6ff61

Please sign in to comment.