sound: oss: off by one bug

The problem is that in the original code sound_nblocks could go up to 1024
which would be an array overflow.

This was found with a static checker and has been compile tested only.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c
index 08274c995d0625e78cabd097617ad1e4a3b290b7..727bdb9ba2dc1bc9b0cc62fd8abde19403ca292d 100644 (file)
--- a/sound/oss/dev_table.c
+++ b/sound/oss/dev_table.c
@@ -67,14 +67,15 @@ int sound_install_audiodrv(int vers, char *name, struct audio_driver *driver,
                return -(EBUSY);
        }
        d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver)));
-
-       if (sound_nblocks < 1024)
-               sound_nblocks++;
+       sound_nblocks++;
+       if (sound_nblocks >= MAX_MEM_BLOCKS)
+               sound_nblocks = MAX_MEM_BLOCKS - 1;
 
        op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations)));
+       sound_nblocks++;
+       if (sound_nblocks >= MAX_MEM_BLOCKS)
+               sound_nblocks = MAX_MEM_BLOCKS - 1;
 
-       if (sound_nblocks < 1024)
-               sound_nblocks++;
        if (d == NULL || op == NULL) {
                printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name);
                sound_unload_audiodev(num);
@@ -128,9 +129,10 @@ int sound_install_mixer(int vers, char *name, struct mixer_operations *driver,
           until you unload sound! */
           
        op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations)));
+       sound_nblocks++;
+       if (sound_nblocks >= MAX_MEM_BLOCKS)
+               sound_nblocks = MAX_MEM_BLOCKS - 1;
 
-       if (sound_nblocks < 1024)
-               sound_nblocks++;
        if (op == NULL) {
                printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name);
                return -ENOMEM;

diff --git a/sound/oss/sound_config.h b/sound/oss/sound_config.h
index 55271fbe7f49c44274658ce6ba7756c8f5faa5b8..9d35c4c65b9b0f0f4eb8f1026f89344ae8528415 100644 (file)
--- a/sound/oss/sound_config.h
+++ b/sound/oss/sound_config.h
@@ -142,4 +142,6 @@ static inline int translate_mode(struct file *file)
 #define TIMER_ARMED    121234
 #define TIMER_NOT_ARMED        1
 
+#define MAX_MEM_BLOCKS 1024
+
 #endif

diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
index 61aaedae6b7e084f8d7359d28fc88d9e4493e490..c62530943888aaf26a18d3f11dd8afd6a80ff019 100644 (file)
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -56,7 +56,7 @@
 /*
  * Table for permanently allocated memory (used when unloading the module)
  */
-void *          sound_mem_blocks[1024];
+void *          sound_mem_blocks[MAX_MEM_BLOCKS];
 int             sound_nblocks = 0;
 
 /* Persistent DMA buffers */
@@ -574,7 +574,7 @@ static int __init oss_init(void)
                                      NULL, "%s%d", dev_list[i].name, j);
        }
 
-       if (sound_nblocks >= 1024)
+       if (sound_nblocks >= MAX_MEM_BLOCKS - 1)
                printk(KERN_ERR "Sound warning: Deallocation table was too small.\n");
        
        return 0;