From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752678Ab1KAIrR (ORCPT ); Tue, 1 Nov 2011 04:47:17 -0400 Received: from cantor2.suse.de ([195.135.220.15]:59819 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752134Ab1KAIrQ (ORCPT ); Tue, 1 Nov 2011 04:47:16 -0400 Date: Tue, 01 Nov 2011 09:47:14 +0100 Message-ID: From: Takashi Iwai To: Alexander Stein Cc: Jaroslav Kysela , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] hda_hwdep: Fix possible buffer overflow In-Reply-To: <1320136807-4956-1-git-send-email-alexander.stein@systec-electronic.com> References: <1320136807-4956-1-git-send-email-alexander.stein@systec-electronic.com> User-Agent: Wanderlust/2.15.6 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.7 Emacs/23.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org At Tue, 1 Nov 2011 09:40:07 +0100, Alexander Stein wrote: > > If a line in the firmware file is larger than the given buffer size (and > so the firmware file size), size is set to a value larger than the actual > buffer size. This results in an overflow in the buffer passed. > > Signed-off-by: Alexander Stein > --- > Changes in v2: > * Just remove the erroneous check Thanks, applied now. Takashi > > sound/pci/hda/hda_hwdep.c | 2 -- > 1 files changed, 0 insertions(+), 2 deletions(-) > > diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c > index 72e5885..7e7d078 100644 > --- a/sound/pci/hda/hda_hwdep.c > +++ b/sound/pci/hda/hda_hwdep.c > @@ -756,8 +756,6 @@ static int get_line_from_fw(char *buf, int size, struct firmware *fw) > } > if (!fw->size) > return 0; > - if (size < fw->size) > - size = fw->size; > > for (len = 0; len < fw->size; len++) { > if (!*p) > -- > 1.7.3.4 >