瀏覽代碼

ALSA: hda - potential (but unlikely) uninitialized variable

This function is a bit unusual because it accepts negative values as
"conn_len".  It's theoretically possible for both "cache_len" and
"conn_len" to be -ENOSPC and in that case we would oops trying to run
memcmp() on the uninitialized "list" pointer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dan Carpenter 10 年之前
父節點
當前提交
f4d7703179
共有 1 個文件被更改,包括 2 次插入2 次删除
  1. 2 2
      sound/pci/hda/hda_proc.c

+ 2 - 2
sound/pci/hda/hda_proc.c

@@ -582,8 +582,8 @@ static void print_conn_list(struct snd_info_buffer *buffer,
 
 
 	/* Get Cache connections info */
 	/* Get Cache connections info */
 	cache_len = snd_hda_get_conn_list(codec, nid, &list);
 	cache_len = snd_hda_get_conn_list(codec, nid, &list);
-	if (cache_len != conn_len
-			|| memcmp(list, conn, conn_len)) {
+	if (cache_len >= 0 && (cache_len != conn_len ||
+			      memcmp(list, conn, conn_len) != 0)) {
 		snd_iprintf(buffer, "  In-driver Connection: %d\n", cache_len);
 		snd_iprintf(buffer, "  In-driver Connection: %d\n", cache_len);
 		if (cache_len > 0) {
 		if (cache_len > 0) {
 			snd_iprintf(buffer, "    ");
 			snd_iprintf(buffer, "    ");