sound: oss: off by one bug
The problem is that in the original code sound_nblocks could go up to 1024
which would be an array overflow.
This was found with a static checker and has been compile tested only.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
diff --git a/sound/oss/dev_table.c b/sound/oss/dev_table.c
index 08274c9..727bdb9 100644
--- a/sound/oss/dev_table.c
+++ b/sound/oss/dev_table.c
@@ -67,14 +67,15 @@
return -(EBUSY);
}
d = (struct audio_driver *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_driver)));
-
- if (sound_nblocks < 1024)
- sound_nblocks++;
+ sound_nblocks++;
+ if (sound_nblocks >= MAX_MEM_BLOCKS)
+ sound_nblocks = MAX_MEM_BLOCKS - 1;
op = (struct audio_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct audio_operations)));
+ sound_nblocks++;
+ if (sound_nblocks >= MAX_MEM_BLOCKS)
+ sound_nblocks = MAX_MEM_BLOCKS - 1;
- if (sound_nblocks < 1024)
- sound_nblocks++;
if (d == NULL || op == NULL) {
printk(KERN_ERR "Sound: Can't allocate driver for (%s)\n", name);
sound_unload_audiodev(num);
@@ -128,9 +129,10 @@
until you unload sound! */
op = (struct mixer_operations *) (sound_mem_blocks[sound_nblocks] = vmalloc(sizeof(struct mixer_operations)));
+ sound_nblocks++;
+ if (sound_nblocks >= MAX_MEM_BLOCKS)
+ sound_nblocks = MAX_MEM_BLOCKS - 1;
- if (sound_nblocks < 1024)
- sound_nblocks++;
if (op == NULL) {
printk(KERN_ERR "Sound: Can't allocate mixer driver for (%s)\n", name);
return -ENOMEM;