pcm_hw: Fix buffer overflow in chmap

We can't calculate memory storage in bytes, when we're supposed
to store ints in it!

Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/src/pcm/pcm_hw.c b/src/pcm/pcm_hw.c
index 196393d076215e170398fb6c99db85198abf693c..9ff83a92c41e58bb254e709120a88484f44fa4ba 100644 (file)
--- a/src/pcm/pcm_hw.c
+++ b/src/pcm/pcm_hw.c
@@ -1187,7 +1187,7 @@ static snd_pcm_chmap_t *snd_pcm_hw_get_chmap(snd_pcm_t *pcm)
                       snd_pcm_state_name(FAST_PCM_STATE(hw)));
                return NULL;
        }
-       map = malloc(pcm->channels + 1);
+       map = malloc(pcm->channels * sizeof(map->pos[0]) + sizeof(*map));
        if (!map)
                return NULL;
        map->channels = pcm->channels;