PATCH: azalia(4) invalid index crash

[Alexey Suslikov]

Hi tech@.

See http://marc.info/?l=openbsd-bugs&m=141867088702648&w=2

Reported by t...@openmailbox.org, John M. Molloy <moll...@acm.org>
and confirmed this diff to fix an issue.

--- azalia.c.orig       Mon Dec 15 23:23:14 2014
+++ azalia.c    Wed Dec 17 13:42:41 2014
@@ -2348,14 +2348,23 @@
                                if (ret >= 0)
                                        return ret;
                        }
-               } else {
-                       index = w->connections[w->selected];
-                       if (VALID_WIDGET_NID(index, this)) {
-                               ret = azalia_codec_find_defdac(this, index,
-                                   depth);
-                               if (ret >= 0)
-                                       return ret;
-                       }
+               /* 7.3.3.2 Connection Select Control
+                * If an attempt is made to Set an index value greater than
+                * the number of list entries (index is equal to or greater
+                * than the Connection List Length property for the widget)
+                * the behavior is not predictable.
+                */
+
+               /* negative index values are wrong too */
+               } else if (w->selected >= 0 &&
+                       w->selected < sizeof(w->connections)) {
+                               index = w->connections[w->selected];
+                               if (VALID_WIDGET_NID(index, this)) {
+                                       ret = azalia_codec_find_defdac(this,
+                                               index, depth);
+                                       if (ret >= 0)
+                                               return ret;
+                               }
                }
        }
 
@@ -2393,14 +2402,23 @@
                                if (ret >= 0)
                                        return ret;
                        }
-               } else {
-                       index = w->connections[w->selected];
-                       if (VALID_WIDGET_NID(index, this)) {
-                               ret = azalia_codec_find_defadc_sub(this, node,
-                                   index, depth);
-                               if (ret >= 0)
-                                       return ret;
-                       }
+               /* 7.3.3.2 Connection Select Control
+                * If an attempt is made to Set an index value greater than
+                * the number of list entries (index is equal to or greater
+                * than the Connection List Length property for the widget)
+                * the behavior is not predictable.
+                */
+
+               /* negative index values are wrong too */
+               } else if (w->selected >= 0 &&
+                       w->selected < sizeof(w->connections)) {
+                               index = w->connections[w->selected];
+                               if (VALID_WIDGET_NID(index, this)) {
+                                       ret = azalia_codec_find_defadc_sub(this,
+                                               node, index, depth);
+                                       if (ret >= 0)
+                                               return ret;
+                               }
                }
        }
        return -1;