Commit 78735cff authored by Roel Kluin's avatar Roel Kluin Committed by Takashi Iwai
Browse files

ALSA: hda: fix out-of-bound hdmi_eld.sad[] write 



e->sad[] is declared with size ELD_MAX_SAD=16, but the guard
allows range 0-31.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarWu Fengguang <fengguang.wu@intel.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 626f5cef

sound/pci/hda/hda_eld.c

+2 −2
Original line number Diff line number Diff line
@@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, 
	char name[64];

	char *sname;

	long long val;

	int n;

	unsigned int n;



	while (!snd_info_get_line(buffer, line, sizeof(line))) {

		if (sscanf(line, "%s %llx", name, &val) != 2)
@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, 
				sname++;

				n = 10 * n + name[4] - '0';

			}

			if (n < 0 || n > 31) /* double the CEA limit */

			if (n >= ELD_MAX_SAD)

				continue;

			if (!strcmp(sname, "_coding_type"))

				e->sad[n].format = val;