sound/pci/hda/patch_via.c: array overflow

[Adrian Bunk]

sound/pci/hda/patch_via.c contains the following code:

<--  snip  -->

...
struct via_spec {
...
        hda_nid_t private_dac_nids[4];  
...                               ^^^
};
...
static int vt1709_auto_fill_dac_nids(struct via_spec *spec,
                                     const struct auto_pin_cfg *cfg)
{
...
       spec->multiout.dac_nids = spec->private_dac_nids;

        if (cfg->line_outs == 4) { /* 10 channels */   <------------------
                for (i = 0; i < cfg->line_outs; i++) {
                        nid = cfg->line_out_pins[i];
                        if (nid) {
                                /* config dac list */
                                switch (i) {
                                case AUTO_SEQ_FRONT:
                                        /* AOW0 */
                                        spec->multiout.dac_nids[i] = 0x10;
                                        break;
                                case AUTO_SEQ_CENLFE:
                                        /* AOW2 */
                                        spec->multiout.dac_nids[i] = 0x12;
                                        break;
                                case AUTO_SEQ_SURROUND:
                                        /* AOW3 */
                                        spec->multiout.dac_nids[i] = 0x27;
                                        break;
                                case AUTO_SEQ_SIDE:
                                        /* AOW1 */
                                        spec->multiout.dac_nids[i] = 0x11;
                                        break;
                                default:
                                        break;
                                }
                        }
                }
                spec->multiout.dac_nids[cfg->line_outs] = 0x28; /* AOW4 */
...                                     ^^^^^^^^^^^^^^

<--  snip  -->

Spotted by the Coverity checker.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/