272cbc98cf
Stanse found that in snd_usb_parse_audio_endpoints, there is a dangling pointer dereference. When snd_usb_parse_audio_format fails, fp is freed, and continue invoked. On the next loop, there is "fp && fp->altsetting == 1 && fp->channels == 1" test, but fp is set from the last iteration (but is bogus) and thus ilegally dereferenced. Set fp to NULL before "continue". Signed-off-by: Jiri Slaby <jslaby@suse.cz> Acked-by: Daniel Mack <daniel@caiaq.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
aoa | ||
arm | ||
atmel | ||
core | ||
drivers | ||
i2c | ||
isa | ||
mips | ||
oss | ||
parisc | ||
pci | ||
pcmcia | ||
ppc | ||
sh | ||
soc | ||
sparc | ||
spi | ||
synth | ||
usb | ||
ac97_bus.c | ||
Kconfig | ||
last.c | ||
Makefile | ||
sound_core.c | ||
sound_firmware.c |