summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorClemens Ladisch <clemens@ladisch.de>2014-08-21 20:55:21 +0200
committerTakashi Iwai <tiwai@suse.de>2014-08-22 07:21:05 +0200
commitddc64b278a4dda052390b3de1b551e59acdff105 (patch)
tree8558903d00277fdb90191da087927fe66a1dd130
parentca2e7224d7e7d424e69616634f90f3f428710085 (diff)
ALSA: core: fix buffer overflow in snd_info_get_line()
snd_info_get_line() documents that its last parameter must be one less than the buffer size, but this API design guarantees that (literally) every caller gets it wrong. Just change this parameter to have its obvious meaning. Reported-by: Tommi Rantala <tt.rantala@gmail.com> Cc: <stable@vger.kernel.org> # v2.2.26+ Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/core/info.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/core/info.c b/sound/core/info.c
index 051d55b05521..9f404e965ea2 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -684,7 +684,7 @@ int snd_info_card_free(struct snd_card *card)
* snd_info_get_line - read one line from the procfs buffer
* @buffer: the procfs buffer
* @line: the buffer to store
- * @len: the max. buffer size - 1
+ * @len: the max. buffer size
*
* Reads one line from the buffer and stores the string.
*
@@ -704,7 +704,7 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
buffer->stop = 1;
if (c == '\n')
break;
- if (len) {
+ if (len > 1) {
len--;
*line++ = c;
}