github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-25 15:41:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: control - off by one in store_mode()

Browse Source 
If count is 16 then this will put the NUL terminator one element beyond
the end of the array.

Fixes: cb17fe0045 ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YGcDOtrimR46vr0k@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Dan Carpenter 2021-04-02 14:42:50 +03:00 committed by Takashi Iwai
parent 1678320e74
commit 53cc2643c1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/core/control_led.c
View File

@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr,
{
struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev);
char _buf[16];
size_t l = min(count, sizeof(_buf) - 1) + 1;
size_t l = min(count, sizeof(_buf) - 1);
enum snd_ctl_led_mode mode;
memcpy(_buf, buf, l);