ALSA: asihpi: Fix potential OOB array access

[ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ]

ASIHPI driver stores some values in the static array upon a response
from the driver, and its index depends on the firmware.  We shouldn't
trust it blindly.

This patch adds a sanity check of the array index to fit in the array
size.

Link: https://patch.msgid.link/20240808091454.30846-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/sound/pci/asihpi/hpimsgx.c b/sound/pci/asihpi/hpimsgx.c
index f7427f8eb6303e0d63c27940a9c96fb1f4c4e835..761fc62f68f16c7646df8a5dff4d7ac9058b6d49 100644 (file)
--- a/sound/pci/asihpi/hpimsgx.c
+++ b/sound/pci/asihpi/hpimsgx.c
@@ -713,7 +713,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm,
                phr->error = HPI_ERROR_PROCESSING_MESSAGE;
                return phr->error;
        }
-       if (hr.error == 0) {
+       if (hr.error == 0 && hr.u.s.adapter_index < HPI_MAX_ADAPTERS) {
                /* the adapter was created successfully
                   save the mapping for future use */
                hpi_entry_points[hr.u.s.adapter_index] = entry_point_func;