ALSA: usb/mixer: remove bogus cast
authorDan Carpenter <error27@gmail.com>
Thu, 16 Sep 2010 18:13:47 +0000 (20:13 +0200)
committerTakashi Iwai <tiwai@suse.de>
Thu, 16 Sep 2010 20:50:51 +0000 (22:50 +0200)
"uinfo->value.enumerated.item" is an unsigned int.  If it's negative
when we do the comparison:
if ((int)uinfo->value.enumerated.item >= cval->max)
then we would read past the end of the array on the next line.

I also changed the strcpy() to strlcpy() out of paranoia.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
sound/usb/mixer.c

index 5f12e294b0f884d6a8d1f2392c17733cb60cb6bf..f2d74d654b3c3302b6dbe353ae8be95484c16ccf 100644 (file)
@@ -1640,9 +1640,10 @@ static int mixer_ctl_selector_info(struct snd_kcontrol *kcontrol, struct snd_ctl
        uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
        uinfo->count = 1;
        uinfo->value.enumerated.items = cval->max;
-       if ((int)uinfo->value.enumerated.item >= cval->max)
+       if (uinfo->value.enumerated.item >= cval->max)
                uinfo->value.enumerated.item = cval->max - 1;
-       strcpy(uinfo->value.enumerated.name, itemlist[uinfo->value.enumerated.item]);
+       strlcpy(uinfo->value.enumerated.name, itemlist[uinfo->value.enumerated.item],
+               sizeof(uinfo->value.enumerated.name));
        return 0;
 }