2021-05-19 19:28:10

by Colin King

Subject: [PATCH][next] ALSA: rawmidi: fix incorrect array bounds check on clock_names

From: Colin Ian King <[email protected]>

The array bounds check on clock_names is currently checking the size
of the entire array rather than the number of elements in the array
leading to a potential array bounds read error. Fix this by using
the ARRAY_SIZE macro instead of sizeof.

Addresses-Coverity: ("Out-of-bounds read")
Fixes: 08fdced60ca0 ("ALSA: rawmidi: Add framing mode")
Signed-off-by: Colin Ian King <[email protected]>
---
sound/core/rawmidi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 4a6534db77d6..6c0a4a67ad2e 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1679,7 +1679,7 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
buffer_size, avail, xruns);
if (substream->framing == SNDRV_RAWMIDI_MODE_FRAMING_TSTAMP) {
clock_type = substream->clock_type >> SNDRV_RAWMIDI_MODE_CLOCK_SHIFT;
- if (!snd_BUG_ON(clock_type >= sizeof(clock_names)))
+ if (!snd_BUG_ON(clock_type >= ARRAY_SIZE(clock_names)))
snd_iprintf(buffer,
" Framing : tstamp\n"
" Clock type : %s\n",
--
2.31.1

2021-05-19 20:06:35

by Takashi Iwai

Subject: Re: [PATCH][next] ALSA: rawmidi: fix incorrect array bounds check on clock_names

On Wed, 19 May 2021 12:54:24 +0200,
Colin King wrote:
>
> From: Colin Ian King <[email protected]>
>
> The array bounds check on clock_names is currently checking the size
> of the entire array rather than the number of elements in the array
> leading to a potential array bounds read error. Fix this by using
> the ARRAY_SIZE macro instead of sizeof.
>
> Addresses-Coverity: ("Out-of-bounds read")
> Fixes: 08fdced60ca0 ("ALSA: rawmidi: Add framing mode")
> Signed-off-by: Colin Ian King <[email protected]>

Thanks, applied.


Takashi