fix read beyond end of array in gus_wave.c

G'day list

Nix the last patch, sorry but the next coverity error in the list was an identical problem in the same file. So here is a combined patch for the two errors. (I looked and I don't think there are anymore now)

Coverity spotted a static overrun in sound/oss/gus_wave.c @ line 1099 & 1754.

This is not a big problem as it is oss, but I thought I should submit a patch anyway.

The patch below just extends the earlier checks of the array index to catch the (array + 1) error.

@@ -1085,7 +1085,7 @@ static int guswave_set_instr(int dev, in
 {
 	int sample_no;
 
-	if (instr_no < 0 || instr_no > MAX_PATCH)
+	if (instr_no < 0 || instr_no >= MAX_PATCH)
 		instr_no = 0;	/* Default to acoustic piano */
 
 	if (voice < 0 || voice > 31)

@@ -1676,7 +1676,7 @@ static int guswave_load_patch(int dev, i
 
 	instr = patch.instr_no;
 
-	if (instr < 0 || instr > MAX_PATCH)
+	if (instr < 0 || instr >= MAX_PATCH)
 	{
 /*		printk(KERN_ERR "GUS: Invalid patch number %d\n", instr);*/
 		return -EINVAL;

_______________________________________________
Kernel-janitors mailing list
[email protected]
https://lists.osdl.org/mailman/listinfo/kernel-janitors