lkml.org 
[lkml]   [2006]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    Subjectsound/pci/ac97/ac97_patch.c: possible negative array index
    The Coverity checker noted the following in sound/pci/ac97/ac97_patch.c:

    <-- snip -->

    ...
    static int patch_ad1881_chained1(struct snd_ac97 * ac97, int idx, unsigned short codec_bits)
    {
    static int cfg_bits[3] = { 1<<12, 1<<14, 1<<13 };
    unsigned short val;

    snd_ac97_update_bits(ac97, AC97_AD_SERIAL_CFG, 0x7000, cfg_bits[idx]);
    snd_ac97_write_cache(ac97, AC97_AD_CODEC_CFG, 0x0004); // SDIE
    val = snd_ac97_read(ac97, AC97_VENDOR_ID2);
    if ((val & 0xff40) != 0x5340)
    return 0;
    if (codec_bits)
    snd_ac97_write_cache(ac97, AC97_AD_CODEC_CFG, codec_bits);
    ac97->spec.ad18xx.chained[idx] = cfg_bits[idx];
    ac97->spec.ad18xx.id[idx] = val;
    ac97->spec.ad18xx.codec_cfg[idx] = codec_bits ? codec_bits : 0x0004;
    return 1;
    }

    static void patch_ad1881_chained(struct snd_ac97 * ac97, int unchained_idx, int cidx1, int cidx2)
    {
    // already detected?
    if (ac97->spec.ad18xx.unchained[cidx1] || ac97->spec.ad18xx.chained[cidx1])
    cidx1 = -1;
    if (ac97->spec.ad18xx.unchained[cidx2] || ac97->spec.ad18xx.chained[cidx2])
    cidx2 = -1;
    if (cidx1 < 0 && cidx2 < 0)
    return;
    // test for chained codecs
    snd_ac97_update_bits(ac97, AC97_AD_SERIAL_CFG, 0x7000,
    ac97->spec.ad18xx.unchained[unchained_idx]);
    snd_ac97_write_cache(ac97, AC97_AD_CODEC_CFG, 0x0002); // ID1C
    ac97->spec.ad18xx.codec_cfg[unchained_idx] = 0x0002;
    if (cidx1 >= 0) {
    if (patch_ad1881_chained1(ac97, cidx1, 0x0006)) // SDIE | ID1C
    patch_ad1881_chained1(ac97, cidx2, 0);
    else if (patch_ad1881_chained1(ac97, cidx2, 0x0006)) // SDIE | ID1C
    patch_ad1881_chained1(ac97, cidx1, 0);
    } else if (cidx2 >= 0) {
    patch_ad1881_chained1(ac97, cidx2, 0);
    }
    }
    ...

    <-- snip -->

    If there are in patch_ad1881_chained() (cidx2 == -1) and (cidx1 >= 0),
    -1 will be used as array index in patch_ad1881_chained1().

    cu
    Adrian

    --

    "Is there not promise of rain?" Ling Tan asked suddenly out
    of the darkness. There had been need of rain for many days.
    "Only a promise," Lao Er said.
    Pearl S. Buck - Dragon Seed

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-11-07 19:05    [W:0.024 / U:0.060 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site