git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
ALSA: hda - Read buffer overflow
[pandora-kernel.git]
/
sound
/
pci
/
hda
/
hda_eld.c
diff --git
a/sound/pci/hda/hda_eld.c
b/sound/pci/hda/hda_eld.c
index
fcad5ec
..
9446a5a
100644
(file)
--- a/
sound/pci/hda/hda_eld.c
+++ b/
sound/pci/hda/hda_eld.c
@@
-508,7
+508,7
@@
static void hdmi_write_eld_info(struct snd_info_entry *entry,
char name[64];
char *sname;
long long val;
char name[64];
char *sname;
long long val;
- int n;
+
unsigned
int n;
while (!snd_info_get_line(buffer, line, sizeof(line))) {
if (sscanf(line, "%s %llx", name, &val) != 2)
while (!snd_info_get_line(buffer, line, sizeof(line))) {
if (sscanf(line, "%s %llx", name, &val) != 2)
@@
-539,7
+539,7
@@
static void hdmi_write_eld_info(struct snd_info_entry *entry,
sname++;
n = 10 * n + name[4] - '0';
}
sname++;
n = 10 * n + name[4] - '0';
}
- if (n
< 0 || n > 31) /* double the CEA limit */
+ if (n
>= ELD_MAX_SAD)
continue;
if (!strcmp(sname, "_coding_type"))
e->sad[n].format = val;
continue;
if (!strcmp(sname, "_coding_type"))
e->sad[n].format = val;