From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 2 Apr 2021 11:42:50 +0000 (+0300)
Subject: ALSA: control - off by one in store_mode()
X-Git-Tag: Ubuntu-5.13.0-19.19~3404^2~49
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=53cc2643c1498779c86ee8e038273c2b2d9c8126;p=mirror_ubuntu-jammy-kernel.git

ALSA: control - off by one in store_mode()

If count is 16 then this will put the NUL terminator one element beyond
the end of the array.

Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YGcDOtrimR46vr0k@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index 788fd9e275e0..d756a52e58db 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -391,7 +391,7 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *attr,
 {
 	struct snd_ctl_led *led = container_of(dev, struct snd_ctl_led, dev);
 	char _buf[16];
-	size_t l = min(count, sizeof(_buf) - 1) + 1;
+	size_t l = min(count, sizeof(_buf) - 1);
 	enum snd_ctl_led_mode mode;
 
 	memcpy(_buf, buf, l);