29 Jul
2009
29 Jul
'09
12:25 p.m.
e->sad[] is declared with size ELD_MAX_SAD (16), but the guard allows the range 0-31
Signed-off-by: Roel Kluin roel.kluin@gmail.com --- Found with Parfait, http://research.sun.com/projects/parfait/
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c index fcad5ec..ec04e58 100644 --- a/sound/pci/hda/hda_eld.c +++ b/sound/pci/hda/hda_eld.c @@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry, sname++; n = 10 * n + name[4] - '0'; } - if (n < 0 || n > 31) /* double the CEA limit */ + if (n < 0 || n > ELD_MAX_SAD) continue; if (!strcmp(sname, "_coding_type")) e->sad[n].format = val;