Commit 4a122c10 authored Mar 17, 2011 by Dan Rosenberg Committed by Takashi Iwai Mar 18, 2011

ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl



The user-supplied index into the adapters array needs to be checked, or
an out-of-bounds kernel pointer could be accessed and used, leading to
potentially exploitable memory corruption.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent 98d21df4

sound/pci/asihpi/hpioctl.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -156,6 +156,11 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
		goto out;
		}

		if (hm->h.adapter_index >= HPI_MAX_ADAPTERS) {
		err = -EINVAL;
		goto out;
		}

		pa = &adapters[hm->h.adapter_index];
		hr->h.size = res_max_size;
		if (hm->h.object == HPI_OBJ_SUBSYSTEM) {