[alsa-devel] [PATCH] ALSA: Write outside array bounds

[Roel Kluin]

e->sad[] is declared with size ELD_MAX_SAD (16), but the guard allows
the range 0-31

Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
---
Found with Parfait, http://research.sun.com/projects/parfait/

diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index fcad5ec..ec04e58 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
 				sname++;
 				n = 10 * n + name[4] - '0';
 			}
-			if (n < 0 || n > 31) /* double the CEA limit */
+			if (n < 0 || n > ELD_MAX_SAD)
 				continue;
 			if (!strcmp(sname, "_coding_type"))
 				e->sad[n].format = val;