lkml.org 
[lkml]   [2016]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 063/196] ALSA: hda - Fix static checker warning in patch_hdmi.c
    Date
    3.19.8-ckt16 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: David Henningsson <david.henningsson@canonical.com>

    commit 360a8245680053619205a3ae10e6bfe624a5da1d upstream.

    The static checker warning is:

    sound/pci/hda/patch_hdmi.c:460 hdmi_eld_ctl_get()
    error: __memcpy() 'eld->eld_buffer' too small (256 vs 512)

    I have a hard time figuring out if this can ever cause an information leak
    (I don't think so), but nonetheless it does not hurt to increase the
    robustness of the code.

    Fixes: 68e03de98507 ('ALSA: hda - hdmi: Do not expose eld data when eld is invalid')
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    sound/pci/hda/patch_hdmi.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
    index 6a7fdab..705e6c1 100644
    --- a/sound/pci/hda/patch_hdmi.c
    +++ b/sound/pci/hda/patch_hdmi.c
    @@ -435,7 +435,8 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
    eld = &per_pin->sink_eld;

    mutex_lock(&per_pin->lock);
    - if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data)) {
    + if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data) ||
    + eld->eld_size > ELD_MAX_SIZE) {
    mutex_unlock(&per_pin->lock);
    snd_BUG();
    return -EINVAL;
    --
    2.7.0
    \
     
     \ /
      Last update: 2016-03-09 02:41    [W:4.056 / U:0.464 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site