summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorRoel Kluin <roel.kluin@gmail.com>2009-07-29 11:46:59 +0200
committerTakashi Iwai <tiwai@suse.de>2009-07-29 14:37:12 +0200
commitc45ec06c74512265969aef40b00f320c6afb7a90 (patch)
tree10ee18d623609075cd1b1388ad07add759434f21 /sound
parent4be3bd7849165e7efa6b0b35a23d6a3598d97465 (diff)
downloadlinux-3.10-c45ec06c74512265969aef40b00f320c6afb7a90.tar.gz
linux-3.10-c45ec06c74512265969aef40b00f320c6afb7a90.tar.bz2
linux-3.10-c45ec06c74512265969aef40b00f320c6afb7a90.zip
sound: aedsp16: Buffer overflow
DSPVersion is declared as char[3], but the sprintf writes at least 4 bytes including terminating null. Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r--sound/oss/aedsp16.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/sound/oss/aedsp16.c b/sound/oss/aedsp16.c
index 3ee9900ffd7..35b5912cf3f 100644
--- a/sound/oss/aedsp16.c
+++ b/sound/oss/aedsp16.c
@@ -325,8 +325,9 @@
/*
* Size of character arrays that store name and version of sound card
*/
-#define CARDNAMELEN 15 /* Size of the card's name in chars */
-#define CARDVERLEN 2 /* Size of the card's version in chars */
+#define CARDNAMELEN 15 /* Size of the card's name in chars */
+#define CARDVERLEN 10 /* Size of the card's version in chars */
+#define CARDVERDIGITS 2 /* Number of digits in the version */
#if defined(CONFIG_SC6600)
/*
@@ -410,7 +411,7 @@
static int soft_cfg __initdata = 0; /* bitmapped config */
static int soft_cfg_mss __initdata = 0; /* bitmapped mss config */
-static int ver[CARDVERLEN] __initdata = {0, 0}; /* DSP Ver:
+static int ver[CARDVERDIGITS] __initdata = {0, 0}; /* DSP Ver:
hi->ver[0] lo->ver[1] */
#if defined(CONFIG_SC6600)
@@ -957,7 +958,7 @@ static int __init aedsp16_dsp_version(int port)
* string is finished.
*/
ver[len++] = ret;
- } while (len < CARDVERLEN);
+ } while (len < CARDVERDIGITS);
sprintf(DSPVersion, "%d.%d", ver[0], ver[1]);
DBG(("success.\n"));