diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-04-17 16:19:46 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2015-04-17 15:32:17 +0200 |
| commit | f4d770317997f89bb6997ee3e8dd495cb8356ae9 (patch) | |
| tree | c77e1d3c7907079d5bbdaaa2ff3b3e48107d6881 /sound | |
| parent | 7d4b5e978ad350916b5c3995490b09c4e59cec4a (diff) | |
| download | linux-f4d770317997f89bb6997ee3e8dd495cb8356ae9.tar.bz2 | |
ALSA: hda - potential (but unlikely) uninitialized variable
This function is a bit unusual because it accepts negative values as
"conn_len". It's theoretically possible for both "cache_len" and
"conn_len" to be -ENOSPC and in that case we would oops trying to run
memcmp() on the uninitialized "list" pointer.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/pci/hda/hda_proc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c index ee6230767c64..baaf7ed06875 100644 --- a/sound/pci/hda/hda_proc.c +++ b/sound/pci/hda/hda_proc.c @@ -582,8 +582,8 @@ static void print_conn_list(struct snd_info_buffer *buffer, /* Get Cache connections info */ cache_len = snd_hda_get_conn_list(codec, nid, &list); - if (cache_len != conn_len - || memcmp(list, conn, conn_len)) { + if (cache_len >= 0 && (cache_len != conn_len || + memcmp(list, conn, conn_len) != 0)) { snd_iprintf(buffer, " In-driver Connection: %d\n", cache_len); if (cache_len > 0) { snd_iprintf(buffer, " "); |