ALSA: rawmidi: fix incorrect array bounds check on clock_names
authorColin Ian King <colin.king@canonical.com>
Wed, 19 May 2021 10:54:24 +0000 (11:54 +0100)
committerTakashi Iwai <tiwai@suse.de>
Wed, 19 May 2021 14:20:25 +0000 (16:20 +0200)
The array bounds check on clock_names is currently checking the size
of the entire array rather than the number of elements in the array
leading to a potential array bounds read error. Fix this by using
the ARRAY_SIZE macro instead of sizeof.

Addresses-Coverity: ("Out-of-bounds read")
Fixes: 08fdced60ca0 ("ALSA: rawmidi: Add framing mode")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20210519105424.55221-1-colin.king@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/core/rawmidi.c

index 4a6534db77d67405c19a424621ee3edfe379ee8e..6c0a4a67ad2e39082a12090b7c22acc0f185d936 100644 (file)
@@ -1679,7 +1679,7 @@ static void snd_rawmidi_proc_info_read(struct snd_info_entry *entry,
                                            buffer_size, avail, xruns);
                                if (substream->framing == SNDRV_RAWMIDI_MODE_FRAMING_TSTAMP) {
                                        clock_type = substream->clock_type >> SNDRV_RAWMIDI_MODE_CLOCK_SHIFT;
-                                       if (!snd_BUG_ON(clock_type >= sizeof(clock_names)))
+                                       if (!snd_BUG_ON(clock_type >= ARRAY_SIZE(clock_names)))
                                                snd_iprintf(buffer,
                                                            "  Framing      : tstamp\n"
                                                            "  Clock type   : %s\n",