On Sun, Jan 03, 2021 at 11:35:32PM +0100, Arnd Bergmann wrote:
> @@ -1050,78 +1088,28 @@ static int gbaudio_tplg_create_widget(struct
> gbaudio_module_info *module,
> strlcpy(temp_name, w->name, NAME_SIZE);
> snprintf(w->name, NAME_SIZE, "GB %d %s", module->dev_id, temp_name);
>
> + if (w->type > ARRAY_SIZE(gbaudio_widgets)) {
^^Off by one. >= here. > + ret = -EINVAL; > + goto error; > + } > + *dw = gbaudio_widgets[w->type]; > + dw->name = w->name; regards, dan carpenter

