diff options
| author | Lukas Zaoral <lzaoral@redhat.com> | 2021-07-21 11:15:10 +0200 |
|---|---|---|
| committer | Lukas Zaoral <lzaoral@redhat.com> | 2021-07-21 14:09:14 +0200 |
| commit | a4faa1ca40ae16e4e1970e65da4bf96ddf9fb923 (patch) | |
| tree | 38a6e6d141f4ee2154f16c6b9793970e8a51ba2a | |
| parent | e7dcdafb1edb4721f59562c259b102b2f81ae423 (diff) | |
| download | usbutils-a4faa1ca40ae16e4e1970e65da4bf96ddf9fb923.tar.gz | |
desc-defs.c: fix possible out-of-bound read
Found by static analysis:
Expression (UAC_FORMAT_TYPE_I << 12) + ARRAY_LEN(audio_data_format_type_i)
evaluates to 6 which is the length of the audio_data_format_type_i array.
Therefore, if value is set to 6, the condition evaluates to true and
ouf-of-bound read could occur.
Signed-off-by: Lukas Zaoral <lzaoral@redhat.com>
| -rw-r--r-- | desc-defs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/desc-defs.c b/desc-defs.c index 30afb69..4cad9e7 100644 --- a/desc-defs.c +++ b/desc-defs.c @@ -966,7 +966,7 @@ static void desc_snowflake_dump_uac1_as_interface_wformattag( /* Format codes are 0xTNNN, where T=Type prefix, NNN = format code. */ - if (value <= ((UAC_FORMAT_TYPE_I << 12) + + if (value < ((UAC_FORMAT_TYPE_I << 12) + ARRAY_LEN(audio_data_format_type_i))) { format_string = audio_data_format_type_i[value]; |