"uinfo->value.enumerated.item" is an unsigned int. If it's negative
when we do the comparison:
if ((int)uinfo->value.enumerated.item >= cval->max)
then we would read past the end of the array on the next line.
I also changed the strcpy() to strlcpy() out of paranoia.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
uinfo->count = 1;
uinfo->value.enumerated.items = cval->max;
- if ((int)uinfo->value.enumerated.item >= cval->max)
+ if (uinfo->value.enumerated.item >= cval->max)
uinfo->value.enumerated.item = cval->max - 1;
- strcpy(uinfo->value.enumerated.name, itemlist[uinfo->value.enumerated.item]);
+ strlcpy(uinfo->value.enumerated.name, itemlist[uinfo->value.enumerated.item],
+ sizeof(uinfo->value.enumerated.name));
return 0;
}