Re: [PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow

[Takashi Iwai <tiwai@suse.de>]

On Wed, 29 Jul 2026 09:09:34 +0200,
wangdich9700@163.com wrote:
> 
> From: wangdicheng <wangdicheng@kylinos.cn>
> 
> The bounds check in cx_auto_parse_eapd() happens after the write,
> so when a codec has more than 4 EAPD pins the 5th one gets written
> to eapds[4] which is past the end of the array and clobbers the
> adjacent dynamic_eapd field.


No, it checks right after the increment, then aborts the loop.  So any
overwrite won't happen.


Takashi

> 
> Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
> ---
>  sound/hda/codecs/conexant.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
> index 40da2832ba66..e7a2a073d22c 100644
> --- a/sound/hda/codecs/conexant.c
> +++ b/sound/hda/codecs/conexant.c
> @@ -100,9 +100,9 @@ static void cx_auto_parse_eapd(struct hda_codec *codec)
>  			continue;
>  		if (!(snd_hda_query_pin_caps(codec, nid) & AC_PINCAP_EAPD))
>  			continue;
> -		spec->eapds[spec->num_eapds++] = nid;
>  		if (spec->num_eapds >= ARRAY_SIZE(spec->eapds))
>  			break;
> +		spec->eapds[spec->num_eapds++] = nid;
>  	}
>  
>  	/* NOTE: below is a wild guess; if we have more than two EAPDs,
> -- 
> 2.25.1
>