From: Takashi Iwai Date: Thu, 13 Oct 2011 06:19:09 +0000 (+0200) Subject: ALSA: usb-audio - Fix possible access over audio_feature_info[] array X-Git-Tag: upstream/snapshot3+hdmi~8798^2~23^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=d09c06c6fc240261dde65198774b279d89c35459;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git ALSA: usb-audio - Fix possible access over audio_feature_info[] array The audio_feature_info[] array should contain all entries for UAC2_FU_*, but currently a few last entries are missing. Even though, the driver tries to probe these entries in parse_audio_feature_unit() and may access the range over the array. This patch fixes the bug by limiting the loop size properly using ARRAY_SIZE() instead of a hard-coded magic number. Reported-by: Dan Carpenter Signed-off-by: Takashi Iwai --- diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index b13b7ac..60f65ac 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -1259,7 +1259,7 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void build_feature_ctl(state, _ftr, 0, i, &iterm, unitid, 0); } } else { /* UAC_VERSION_2 */ - for (i = 0; i < 30/2; i++) { + for (i = 0; i < ARRAY_SIZE(audio_feature_info); i++) { unsigned int ch_bits = 0; unsigned int ch_read_only = 0;