diff options
| author | Dan Carpenter <error27@gmail.com> | 2011-07-27 15:02:26 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2011-07-27 16:06:16 +0200 |
| commit | ae6ff61e43fe4f348a7f764ff0c13fb4240da7b8 (patch) | |
| tree | b2c379feee2bfc5f8a632c9cbd872e5e26a04ba3 | |
| parent | 60a6a8425a84fa46a3831ce79197640b8224311b (diff) | |
ALSA: asihpi - off by one in asihpi_hpi_ioctl()
"adapter" is used as an array index in the adapters[] array so
the off by one would make us read past the end.
1c073b67979 "ALSA: asihpi - Remove spurious adapter index check"
reverted Dan Rosenberg's check that would have prevented the
overflow here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/pci/asihpi/hpioctl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c index e0cff0c72e5..9683f84ecdc 100644 --- a/sound/pci/asihpi/hpioctl.c +++ b/sound/pci/asihpi/hpioctl.c @@ -183,7 +183,7 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) u32 adapter = hm->h.adapter_index; struct hpi_adapter *pa = &adapters[adapter]; - if ((adapter > HPI_MAX_ADAPTERS) || (!pa->type)) { + if ((adapter >= HPI_MAX_ADAPTERS) || (!pa->type)) { hpi_init_response(&hr->r0, HPI_OBJ_ADAPTER, HPI_ADAPTER_OPEN, HPI_ERROR_BAD_ADAPTER_NUMBER); |