diff options
| author | Dmitry Osipenko <digetx@gmail.com> | 2022-01-12 22:50:39 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2022-01-28 15:59:19 +0000 |
| commit | 06feec6005c9d9500cd286ec440aabf8b2ddd94d (patch) | |
| tree | e69491266a7c1a6cf6e040a0f6f1afe8c2b0435d /sound | |
| parent | fb25621da5702c104ce0a48de5b174ced09e5b4e (diff) | |
ASoC: hdmi-codec: Fix OOB memory accesses
Correct size of iec_status array by changing it to the size of status
array of the struct snd_aes_iec958. This fixes out-of-bounds slab
read accesses made by memcpy() of the hdmi-codec driver. This problem
is reported by KASAN.
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20220112195039.1329-1-digetx@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/codecs/hdmi-codec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c index b61f980cabdc..b07607a9ecea 100644 --- a/sound/soc/codecs/hdmi-codec.c +++ b/sound/soc/codecs/hdmi-codec.c @@ -277,7 +277,7 @@ struct hdmi_codec_priv { bool busy; struct snd_soc_jack *jack; unsigned int jack_status; - u8 iec_status[5]; + u8 iec_status[AES_IEC958_STATUS_SIZE]; }; static const struct snd_soc_dapm_widget hdmi_widgets[] = { |