From 82530463119dbdc96edffc009eaedcf57bf981a8 Mon Sep 17 00:00:00 2001 From: Jessica Hamilton Date: Thu, 29 Jun 2017 13:53:40 -0700 Subject: [PATCH] hda: prevent buffer overrun for associations array. --- src/add-ons/kernel/drivers/audio/hda/hda_codec.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/add-ons/kernel/drivers/audio/hda/hda_codec.cpp b/src/add-ons/kernel/drivers/audio/hda/hda_codec.cpp index 6892462a1a..c81ab60be2 100644 --- a/src/add-ons/kernel/drivers/audio/hda/hda_codec.cpp +++ b/src/add-ons/kernel/drivers/audio/hda/hda_codec.cpp @@ -640,6 +640,10 @@ hda_widget_get_associations(hda_audio_group* audioGroup) uint32 index = 0; for (uint32 i = 0; i < MAX_ASSOCIATIONS; i++) { for (uint32 j = 0; j < audioGroup->widget_count; j++) { + if (index >= MAX_ASSOCIATIONS) { + TRACE("too many associations, bailing!\n"); + return B_ERROR; + } hda_widget& widget = audioGroup->widgets[j]; if (widget.type != WT_PIN_COMPLEX)