Bug 253

Summary:	another possible out of bounds error in sb_mixer.c from Stanford Checker
Product:	Drivers	Reporter:	Hanna Linder (hannal)
Component:	Sound(OSS)	Assignee:	Muli Ben-Yehuda (mulix)
Status:	CLOSED CODE_FIX
Severity:	low
Priority:	P2
Hardware:	i386
OS:	Linux
Kernel Version:		Subsystem:
Regression:	---	Bisected commit-id:
Bug Depends on:	252
Bug Blocks:

Description Hanna Linder 2003-01-03 16:49:23 UTC

Exact Kernel version: 2.5.48
Distribution: kernel.org
Hardware Environment: unknown
Software Environment: Stanford Checker
Problem Description:
See thread at: http://marc.theaimsgroup.com/?t=104155440600003&r=1&w=2
[BUG] Caller at fault?
/u1/acc/linux/2.5.48/sound/oss/sb_mixer.c:276:sb_common_mixer_set:
ERROR:BUFFER:276:276:Array bounds error: *devc->iomap[32] indexed with [32]
[Callstack: /u1/acc/linux/2.5.48/sound/oss/sb_ess.c:1722:sb_common_mixer_set(_,
32, _, _)] 
int sb_common_mixer_set(sb_devc * devc, int dev, int left, int right)
{
	int regoffs;
	unsigned char val;


Error --->
	regoffs = (*devc->iomap)[dev][LEFT_CHN].regno;

	if (regoffs == 0)
		return -EINVAL;

Steps to reproduce:

Comment 1 Muli Ben-Yehuda 2004-03-20 13:32:23 UTC

I'm taking care of Bug #252; I'll take care of this as well.