Commit 53cc2643 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai

ALSA: control - off by one in store_mode()

If count is 16 then this will put the NUL terminator one element beyond
the end of the array.

Fixes: cb17fe00 ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarJaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YGcDOtrimR46vr0k@mwandaSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 1678320e
...@@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr, ...@@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr,
{ {
struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev); struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev);
char _buf[16]; char _buf[16];
size_t l = min(count, sizeof(_buf) - 1) + 1; size_t l = min(count, sizeof(_buf) - 1);
enum snd_ctl_led_mode mode; enum snd_ctl_led_mode mode;
memcpy(_buf, buf, l); memcpy(_buf, buf, l);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment