sound: oss: off by one bug
The problem is that in the original code sound_nblocks could go up to 1024
which would be an array overflow.
This was found with a static checker and has been compile tested only.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
index 61aaeda..c625309 100644
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -56,7 +56,7 @@
/*
* Table for permanently allocated memory (used when unloading the module)
*/
-void * sound_mem_blocks[1024];
+void * sound_mem_blocks[MAX_MEM_BLOCKS];
int sound_nblocks = 0;
/* Persistent DMA buffers */
@@ -574,7 +574,7 @@
NULL, "%s%d", dev_list[i].name, j);
}
- if (sound_nblocks >= 1024)
+ if (sound_nblocks >= MAX_MEM_BLOCKS - 1)
printk(KERN_ERR "Sound warning: Deallocation table was too small.\n");
return 0;