Am 02.11.2011 13:18, schrieb Andreas Färber:
> Am 02.11.2011 12:56, schrieb Gerd Hoffmann:
>> commit ba43d28916c4f51c19bd7366089155ce81bee058 introduces a bug:
>> The stream-not-found case doesn't error out any more, instead the
>> code silently uses the first stream. Fix it.
>>
>> Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
>> ---
>> hw/intel-hda.c | 2 +-
>> 1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/hw/intel-hda.c b/hw/intel-hda.c
>> index 675b659..b7ec36d 100644
>> --- a/hw/intel-hda.c
>> +++ b/hw/intel-hda.c
>> @@ -401,7 +401,7 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t
>> stnr, bool output,
>> break;
>> }
>> }
>> - if (st == NULL) {
>> + if (s == 4) {
>> return false;
>> }
>> if (st->bpl == NULL) {
>
> The commit message doesn't say it clearly: Is st == NULL impossible?
> If not, this introduces a potential NULL pointer dereference at st->bpl.
Yes, it's impossible. This is the full context:
st = output ? d->st + 4 : d->st;
for (s = 0; s < 4; s++) {
if (stnr == ((st[s].ctl >> 20) & 0x0f)) {
st = st + s;
break;
}
}
d->st is an array: IntelHDAStream st[8];
Kevin
