Bug 253 - another possible out of bounds error in sb_mixer.c from Stanford Checker
Summary: another possible out of bounds error in sb_mixer.c from Stanford Checker
Status: CLOSED CODE_FIX
Alias: None
Product: Drivers
Classification: Unclassified
Component: Sound(OSS) (show other bugs)
Hardware: i386 Linux
: P2 low
Assignee: Muli Ben-Yehuda
URL:
Keywords:
Depends on: 252
Blocks:
  Show dependency tree
 
Reported: 2003-01-03 16:49 UTC by Hanna Linder
Modified: 2004-12-02 07:00 UTC (History)
0 users

See Also:
Kernel Version:
Subsystem:
Regression: ---
Bisected commit-id:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Hanna Linder 2003-01-03 16:49:23 UTC 
Exact Kernel version: 2.5.48
Distribution: kernel.org
Hardware Environment: unknown
Software Environment: Stanford Checker
Problem Description:
See thread at: http://marc.theaimsgroup.com/?t=104155440600003&r=1&w=2
[BUG] Caller at fault?
/u1/acc/linux/2.5.48/sound/oss/sb_mixer.c:276:sb_common_mixer_set:
ERROR:BUFFER:276:276:Array bounds error: *devc->iomap[32] indexed with [32]
[Callstack: /u1/acc/linux/2.5.48/sound/oss/sb_ess.c:1722:sb_common_mixer_set(_,
32, _, _)] 
int sb_common_mixer_set(sb_devc * devc, int dev, int left, int right)
{
	int regoffs;
	unsigned char val;


Error --->
	regoffs = (*devc->iomap)[dev][LEFT_CHN].regno;

	if (regoffs == 0)
		return -EINVAL;

Steps to reproduce:
Comment 1 Muli Ben-Yehuda 2004-03-20 13:32:23 UTC 
I'm taking care of Bug #252; I'll take care of this as well.
Note You need to log in before you can comment on or make changes to this bug.