mirrors/alsa-lib
1
0
Fork 0
mirror of https://github.com/alsa-project/alsa-lib.git synced 2025-11-04 13:30:08 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

topology: decode: Fix channel map memory allocation

Browse source 
Memory allocated on the stack was referenced outside of the function scope
caused undefined behaviour.

Signed-off-by: Piotr Maziarz <piotrx.maziarz@linux.intel.com>
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
This commit is contained in:
Piotr Maziarz 2020-08-31 11:08:54 +02:00 • committed by Jaroslav Kysela
parent ed75249852
commit 1ac965184e
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/topology/ctl.c
View file

@ -1330,7 +1330,6 @@ int tplg_decode_control_enum1(snd_tplg_t *tplg,
void *bin, size_t size) void *bin, size_t size)
{ {
struct snd_soc_tplg_enum_control *ec = bin; struct snd_soc_tplg_enum_control *ec = bin;
struct snd_tplg_channel_map_template cmt;
int i; int i;
if (size < sizeof(*ec)) { if (size < sizeof(*ec)) {
@ -1375,11 +1374,13 @@ int tplg_decode_control_enum1(snd_tplg_t *tplg,
} }
} }
et->map = &cmt; et->map = tplg_calloc(heap, sizeof(struct snd_tplg_channel_map_template));
memset(&cmt, 0, sizeof(cmt)); if (!et->map)
cmt.num_channels = ec->num_channels; return -ENOMEM;
for (i = 0; i < cmt.num_channels; i++) { et->map->num_channels = ec->num_channels;
struct snd_tplg_channel_elem *channel = &cmt.channel[i]; for (i = 0; i < et->map->num_channels; i++) {
struct snd_tplg_channel_elem *channel = &et->map->channel[i];
tplg_log(tplg, 'D', pos + ((void *)&ec->channel[i] - (void *)ec), tplg_log(tplg, 'D', pos + ((void *)&ec->channel[i] - (void *)ec),
"enum: channel size %d", ec->channel[i].size); "enum: channel size %d", ec->channel[i].size);
channel->reg = ec->channel[i].reg; channel->reg = ec->channel[i].reg;