Commit 7b7d6572 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: asihpi: Fix potential OOB array access at reading cache 

find_control() to retrieve a cached info accesses the array with the
given index blindly, which may lead to an OOB array access.
Add a sanity check for avoiding it.

Link: https://sashiko.dev/#/patchset/20260511230121.28606-1-rosenp%40gmail.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260515085606.242284-1-tiwai@suse.de


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 6fd9f6e8

sound/pci/asihpi/hpicmn.c

+6 −0
Original line number Diff line number Diff line
@@ -276,6 +276,12 @@ static short find_control(u16 control_index, 
		return 0;

	}



	if (control_index >= p_cache->control_count) {

		HPI_DEBUG_LOG(VERBOSE, "control_index out of bounce %d\n",

			control_index);

		return 0;

	}



	*pI = p_cache->p_info[control_index];

	if (!*pI) {

		HPI_DEBUG_LOG(VERBOSE, "Uncached Control %d\n",