* [PATCH] ALSA: usb-audio: US16x08: Move overflow check before array access
@ 2022-06-10 16:57 Daniil Dementev
2022-06-13 5:41 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Daniil Dementev @ 2022-06-10 16:57 UTC (permalink / raw)
To: Jaroslav Kysela
Cc: Daniil Dementev, Takashi Iwai, alsa-devel, linux-kernel,
Alexey Khoroshilov
Buffer overflow could occur in the loop "while", due to accessing an
array element before checking the index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Daniil Dementev <d.dementev@ispras.ru>
Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
sound/usb/mixer_us16x08.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
index b7b6f3834ed5..6eb7d93b358d 100644
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -637,10 +637,10 @@ static int snd_get_meter_comp_index(struct snd_us16x08_meter_store *store)
}
} else {
/* skip channels with no compressor active */
- while (!store->comp_store->val[
+ while (store->comp_index <= SND_US16X08_MAX_CHANNELS
+ && !store->comp_store->val[
COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)]
- [store->comp_index - 1]
- && store->comp_index <= SND_US16X08_MAX_CHANNELS) {
+ [store->comp_index - 1]) {
store->comp_index++;
}
ret = store->comp_index++;
--
2.35.1.windows.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ALSA: usb-audio: US16x08: Move overflow check before array access
2022-06-10 16:57 [PATCH] ALSA: usb-audio: US16x08: Move overflow check before array access Daniil Dementev
@ 2022-06-13 5:41 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2022-06-13 5:41 UTC (permalink / raw)
To: Daniil Dementev
Cc: Jaroslav Kysela, Takashi Iwai, alsa-devel, linux-kernel,
Alexey Khoroshilov
On Fri, 10 Jun 2022 18:57:32 +0200,
Daniil Dementev wrote:
>
> Buffer overflow could occur in the loop "while", due to accessing an
> array element before checking the index.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Daniil Dementev <d.dementev@ispras.ru>
> Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Thanks, applied.
Takashi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-06-13 5:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-06-10 16:57 [PATCH] ALSA: usb-audio: US16x08: Move overflow check before array access Daniil Dementev
2022-06-13 5:41 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox