ALSA: hda: fix out-of-bound hdmi_eld.sad[] write

e->sad[] is declared with size ELD_MAX_SAD=16, but the guard
allows range 0-31.

Signed-off-by: Roel Kluin <[email protected]>
Signed-off-by: Wu Fengguang <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>

diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index fcad5ec31773df436d9416e37854a08ecc4d7a23..9446a5abea1314da3888ca586594010cabea4cc4 100644 (file)
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -508,7 +508,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
        char name[64];
        char *sname;
        long long val;
-       int n;
+       unsigned int n;
 
        while (!snd_info_get_line(buffer, line, sizeof(line))) {
                if (sscanf(line, "%s %llx", name, &val) != 2)
@@ -539,7 +539,7 @@ static void hdmi_write_eld_info(struct snd_info_entry *entry,
                                sname++;
                                n = 10 * n + name[4] - '0';
                        }
-                       if (n < 0 || n > 31) /* double the CEA limit */
+                       if (n >= ELD_MAX_SAD)
                                continue;
                        if (!strcmp(sname, "_coding_type"))
                                e->sad[n].format = val;