[alsa-devel] [patch] ALSA: asihpi - off by one in asihpi_hpi_ioctl()
linux at audioscience.com
Wed Jul 27 23:45:22 CEST 2011
On 28/07/11 00:55, Dan Rosenberg wrote:
> On Wed, 2011-07-27 at 15:02 +0300, Dan Carpenter wrote:
>> "adapter" is used as an array index in the adapters array so
>> the off by one would make us read past the end.
> Agreed. I also don't like the fact that the "pa" pointer can be set to
> an arbitrary address because the index isn't checked until after its
> assignment. Even though the fix to the check prevents this pointer from
> being dereferenced if it's out-of-bounds, it's still wrong.
:( I have to agree.
I'll submit another patch that avoids doing this.
> I agree. This code seems to make assumptions in more than one place
> that the adapters array is fully populated with non-NULL elements. At a
> glance, I can't see where such initialization occurs though.
It does, in void __init asihpi_init(void)
... memset(adapters, 0, sizeof(adapters));
More information about the Alsa-devel