[PATCH 1/2] ALSA: hda/conexant: Fix EAPD pin array overflow

[wangdich9700]

From: wangdicheng <wangdicheng@xxxxxxxxxx>

The bounds check in cx_auto_parse_eapd() happens after the write,
so when a codec has more than 4 EAPD pins the 5th one gets written
to eapds[4] which is past the end of the array and clobbers the
adjacent dynamic_eapd field.

Swap the check and the write.

Signed-off-by: wangdicheng <wangdicheng@xxxxxxxxxx>
---
 sound/hda/codecs/conexant.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/hda/codecs/conexant.c b/sound/hda/codecs/conexant.c
index 40da2832ba66..e7a2a073d22c 100644
--- a/sound/hda/codecs/conexant.c
+++ b/sound/hda/codecs/conexant.c
@@ -100,9 +100,9 @@ static void cx_auto_parse_eapd(struct hda_codec *codec)
 			continue;
 		if (!(snd_hda_query_pin_caps(codec, nid) & AC_PINCAP_EAPD))
 			continue;
-		spec->eapds[spec->num_eapds++] = nid;
 		if (spec->num_eapds >= ARRAY_SIZE(spec->eapds))
 			break;
+		spec->eapds[spec->num_eapds++] = nid;
 	}
 
 	/* NOTE: below is a wild guess; if we have more than two EAPDs,
-- 
2.25.1