OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ALSA: core: fix buffer overflow in snd_info_get_line() 

snd_info_get_line() documents that its last parameter must be one
less than the buffer size, but this API design guarantees that
(literally) every caller gets it wrong.

Just change this parameter to have its obvious meaning.

Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: <stable@vger.kernel.org> # v2.2.26+
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Clemens Ladisch 2014-08-21 20:55:21 +02:00 committed by Takashi Iwai
parent ca2e7224d7
commit ddc64b278a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/core/info.c
View File

@ -684,7 +684,7 @@ int snd_info_card_free(struct snd_card *card)
* snd_info_get_line - read one line from the procfs buffer
* @buffer: the procfs buffer
* @line: the buffer to store
* @len: the max. buffer size - 1
* @len: the max. buffer size
*
* Reads one line from the buffer and stores the string.
*
@ -704,7 +704,7 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
buffer->stop = 1;
if (c == '\n')
break;
if (len) {
if (len > 1) {
len--;
*line++ = c;
}