diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-04-02 14:42:50 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2021-04-06 11:30:53 +0200 |
| commit | 53cc2643c1498779c86ee8e038273c2b2d9c8126 (patch) | |
| tree | afa038fbe8b84d4ce1ab8d39808a7486a37f8eea /sound/core | |
| parent | 1678320e74d32054942182b19b1e9b42aaba8b29 (diff) | |
ALSA: control - off by one in store_mode()
If count is 16 then this will put the NUL terminator one element beyond
the end of the array.
Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YGcDOtrimR46vr0k@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core')
| -rw-r--r-- | sound/core/control_led.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/core/control_led.c b/sound/core/control_led.c index 788fd9e275e0..d756a52e58db 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr, { struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev); char _buf[16]; - size_t l = min(count, sizeof(_buf) - 1) + 1; + size_t l = min(count, sizeof(_buf) - 1); enum snd_ctl_led_mode mode; memcpy(_buf, buf, l); |