ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl

The user-supplied index into the adapters array needs to be checked, or an out-of-bounds kernel pointer could be accessed and used, leading to potentially exploitable memory corruption. Signed-off-by: Dan Rosenberg <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
vbatts · Mar 18, 2011 · 4a122c1 · 4a122c1
1 parent 98d21df
commit 4a122c1
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
@@ -156,6 +156,11 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		goto out;
 	}
 
+	if (hm->h.adapter_index >= HPI_MAX_ADAPTERS) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	pa = &adapters[hm->h.adapter_index];
 	hr->h.size = res_max_size;
 	if (hm->h.object == HPI_OBJ_SUBSYSTEM) {