Skip to content

Commit 3ddbe35

Browse files
dementev-dvtiwai
authored andcommitted
ALSA: usb-audio: US16x08: Move overflow check before array access
Buffer overflow could occur in the loop "while", due to accessing an array element before checking the index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Daniil Dementev <d.dementev@ispras.ru> Reviewed-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Link: https://lore.kernel.org/r/20220610165732.2904-1-d.dementev@ispras.ru Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent b2e6b3d commit 3ddbe35

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

sound/usb/mixer_us16x08.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -637,10 +637,10 @@ static int snd_get_meter_comp_index(struct snd_us16x08_meter_store *store)
637637
}
638638
} else {
639639
/* skip channels with no compressor active */
640-
while (!store->comp_store->val[
640+
while (store->comp_index <= SND_US16X08_MAX_CHANNELS
641+
&& !store->comp_store->val[
641642
COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)]
642-
[store->comp_index - 1]
643-
&& store->comp_index <= SND_US16X08_MAX_CHANNELS) {
643+
[store->comp_index - 1]) {
644644
store->comp_index++;
645645
}
646646
ret = store->comp_index++;

0 commit comments

Comments
 (0)