Commit 53cc2643 authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai
Browse files

ALSA: control - off by one in store_mode() 



If count is 16 then this will put the NUL terminator one element beyond
the end of the array.

Fixes: cb17fe00 ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarJaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YGcDOtrimR46vr0k@mwanda


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 1678320e

sound/core/control_led.c

+1 −1
Original line number Diff line number Diff line
@@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr, 
{

	struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev);

	char _buf[16];

	size_t l = min(count, sizeof(_buf) - 1) + 1;

	size_t l = min(count, sizeof(_buf) - 1);

	enum snd_ctl_led_mode mode;



	memcpy(_buf, buf, l);