提交 5934d9a0 编写于 作者: D Dan Carpenter 提交者: Takashi Iwai

ALSA: control: Re-order bounds checking in get_ctl_id_hash()

These two checks are in the reverse order so it might read one element
beyond the end of the array.  First check if the "i" is within bounds
before using it.

Fixes: 6ab55ec0 ("ALSA: control: Fix an out-of-bounds bug in get_ctl_id_hash()")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YwjgNh/gkG1hH7po@kiliSigned-off-by: NTakashi Iwai <tiwai@suse.de>
上级 6ab55ec0
...@@ -391,7 +391,7 @@ static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id) ...@@ -391,7 +391,7 @@ static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
h = id->iface; h = id->iface;
h = MULTIPLIER * h + id->device; h = MULTIPLIER * h + id->device;
h = MULTIPLIER * h + id->subdevice; h = MULTIPLIER * h + id->subdevice;
for (i = 0; id->name[i] && i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN; i++) for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
h = MULTIPLIER * h + id->name[i]; h = MULTIPLIER * h + id->name[i];
h = MULTIPLIER * h + id->index; h = MULTIPLIER * h + id->index;
h &= LONG_MAX; h &= LONG_MAX;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册