Skip to content

Commit

Permalink
ALSA: control - off by one in store_mode()
Browse files Browse the repository at this point in the history
If count is 16 then this will put the NUL terminator one element beyond
the end of the array.

Fixes: cb17fe0 ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YGcDOtrimR46vr0k@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Dan Carpenter authored and Takashi Iwai committed Apr 6, 2021
1 parent 1678320 commit 53cc264
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion sound/core/control_led.c
Original file line number Diff line number Diff line change
Expand Up @@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr,
{
struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev);
char _buf[16];
size_t l = min(count, sizeof(_buf) - 1) + 1;
size_t l = min(count, sizeof(_buf) - 1);
enum snd_ctl_led_mode mode;

memcpy(_buf, buf, l);
Expand Down

0 comments on commit 53cc264

Please sign in to comment.