diff mbox series

ALSA: control: Re-order bounds checking in get_ctl_id_hash()

Message ID YwjgNh/gkG1hH7po@kili (mailing list archive)
State Accepted
Commit 5934d9a0383619c14df91af8fd76261dc3de2f5f
Headers show
Series ALSA: control: Re-order bounds checking in get_ctl_id_hash() | expand

Commit Message

Dan Carpenter Aug. 26, 2022, 3:01 p.m. UTC 
These two checks are in the reverse order so it might read one element
beyond the end of the array.  First check if the "i" is within bounds
before using it.

Fixes: 6ab55ec0a938 ("ALSA: control: Fix an out-of-bounds bug in get_ctl_id_hash()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 sound/core/control.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Takashi Iwai Aug. 26, 2022, 3:17 p.m. UTC | #1 
On Fri, 26 Aug 2022 17:01:10 +0200,
Dan Carpenter wrote:
> 
> These two checks are in the reverse order so it might read one element
> beyond the end of the array.  First check if the "i" is within bounds
> before using it.
> 
> Fixes: 6ab55ec0a938 ("ALSA: control: Fix an out-of-bounds bug in get_ctl_id_hash()")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Thanks, applied.


Takashi
diff mbox series

Patch

diff --git a/sound/core/control.c b/sound/core/control.c
index e8fc4c511e5f..a7271927d875 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -391,7 +391,7 @@  static unsigned long get_ctl_id_hash(const struct snd_ctl_elem_id *id)
 	h = id->iface;
 	h = MULTIPLIER * h + id->device;
 	h = MULTIPLIER * h + id->subdevice;
-	for (i = 0; id->name[i] && i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN; i++)
+	for (i = 0; i < SNDRV_CTL_ELEM_ID_NAME_MAXLEN && id->name[i]; i++)
 		h = MULTIPLIER * h + id->name[i];
 	h = MULTIPLIER * h + id->index;
 	h &= LONG_MAX;