From: Roel Kluin <roel.kluin@gmail.com>
Date: Wed, 29 Jul 2009 12:35:20 +0000 (+0200)
Subject: ALSA: hda: fix out-of-bound hdmi_eld.sad[] write
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=78735cffc2d9ab0dec32f1ba7cbc1d84b45bbf29;p=GitHub%2FLineageOS%2Fandroid_kernel_samsung_universal7580.git

ALSA: hda: fix out-of-bound hdmi_eld.sad[] write

e->sad[] is declared with size ELD_MAX_SAD=16, but the guard
allows range 0-31.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index fcad5ec3177..9446a5abea1 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
 	char name[64];
 	char *sname;
 	long long val;
-	int n;
+	unsigned int n;
 
 	while (!snd_info_get_line(buffer, line, sizeof(line))) {
 		if (sscanf(line, "%s %llx", name, &val) != 2)
@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
 				sname++;
 				n = 10 * n + name[4] - '0';
 			}
-			if (n < 0 || n > 31) /* double the CEA limit */
+			if (n >= ELD_MAX_SAD)
 				continue;
 			if (!strcmp(sname, "_coding_type"))
 				e->sad[n].format = val;