[ALSA] snd-ak4114: Fix two array overflows

Fix the handling of the TXCSB registers cache. There was one array overflow in reg_write() and one in snd_ak4114_reg_write(). Thanks to David Binderman for reporting the latter. The second overflow probably doesn't matter much, given that the function snd_ak4114_reg_write() appears to be never called. I wonder why it exists and why it is exported. Signed-off-by: Jean Delvare <[email protected]> Signed-off-by: Takashi Iwai <[email protected]> Signed-off-by: Jaroslav Kysela <[email protected]>
hjking · Feb 9, 2007 · 1ab774e · 1ab774e
1 parent 66e2778
commit 1ab774e
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
@@ -42,8 +42,8 @@ static void reg_write(struct ak4114 *ak4114, unsigned char reg, unsigned char va
 	ak4114->write(ak4114->private_data, reg, val);
 	if (reg <= AK4114_REG_INT1_MASK)
 		ak4114->regmap[reg] = val;
-	else if (reg >= AK4114_REG_RXCSB0 && reg <= AK4114_REG_TXCSB4)
-		ak4114->txcsb[reg-AK4114_REG_RXCSB0] = val;
+	else if (reg >= AK4114_REG_TXCSB0 && reg <= AK4114_REG_TXCSB4)
+		ak4114->txcsb[reg-AK4114_REG_TXCSB0] = val;
 }
 
 static inline unsigned char reg_read(struct ak4114 *ak4114, unsigned char reg)
@@ -127,7 +127,8 @@ void snd_ak4114_reg_write(struct ak4114 *chip, unsigned char reg, unsigned char
 	if (reg <= AK4114_REG_INT1_MASK)
 		reg_write(chip, reg, (chip->regmap[reg] & ~mask) | val);
 	else if (reg >= AK4114_REG_TXCSB0 && reg <= AK4114_REG_TXCSB4)
-		reg_write(chip, reg, (chip->txcsb[reg] & ~mask) | val);
+		reg_write(chip, reg,
+			  (chip->txcsb[reg-AK4114_REG_TXCSB0] & ~mask) | val);
 }
 
 void snd_ak4114_reinit(struct ak4114 *chip)