summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorClemens Ladisch <clemens@ladisch.de>2014-08-21 20:55:21 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-10-05 14:52:11 -0700
commit80669110f1e6d653448179e12d40cd8a713ee4a0 (patch)
tree3ced917c84061c311bc55378014b70d17bfda576 /sound
parentf1cb0494aa7cdec998bb63ead445de5f959ce625 (diff)
downloadlwn-80669110f1e6d653448179e12d40cd8a713ee4a0.tar.gz
lwn-80669110f1e6d653448179e12d40cd8a713ee4a0.zip
ALSA: core: fix buffer overflow in snd_info_get_line()
commit ddc64b278a4dda052390b3de1b551e59acdff105 upstream. snd_info_get_line() documents that its last parameter must be one less than the buffer size, but this API design guarantees that (literally) every caller gets it wrong. Just change this parameter to have its obvious meaning. Reported-by: Tommi Rantala <tt.rantala@gmail.com> Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'sound')
-rw-r--r--sound/core/info.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/core/info.c b/sound/core/info.c
index e79baa11b60e..08070e1eefeb 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -679,7 +679,7 @@ int snd_info_card_free(struct snd_card *card)
* snd_info_get_line - read one line from the procfs buffer
* @buffer: the procfs buffer
* @line: the buffer to store
- * @len: the max. buffer size - 1
+ * @len: the max. buffer size
*
* Reads one line from the buffer and stores the string.
*
@@ -699,7 +699,7 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
buffer->stop = 1;
if (c == '\n')
break;
- if (len) {
+ if (len > 1) {
len--;
*line++ = c;
}