sound: Fix buffer overflow in square wave generation
authorAndrew Scull <ascull@google.com>
Sun, 3 Apr 2022 10:39:13 +0000 (10:39 +0000)
committerTom Rini <trini@konsulko.com>
Fri, 29 Apr 2022 15:11:36 +0000 (11:11 -0400)
commit49209da54f9580c80e96b5a33351d24d59599926
tree82ca848d43781892264c14548e7bfc85c18d79bb
parentbeb341ae7f43a4424ca321315a25fe9133030de2
sound: Fix buffer overflow in square wave generation

Data is written for each channel but is only tracked as having one
channel written. This resulted in a buffer overflow and corruption of
the allocator's metadata which caused further problems when the buffer
was later freed. This could be observed with sandbox unit tests.

Resolve the overflow by tracking the writes for each channel.

Fixes: f987177db9 ("dm: sound: Use the correct number of channels for sound")
Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
drivers/sound/sound.c