ALSA: usb-audio: Add length check after string desc copy
It might be possible that negative error code is returned in 'len', when we try to copy USB string desc into the ID name buf of snd_kcontrol instance. But even in that case, we are terminating buf with 0 at the 'len' index, which leads to memory corruption. And for good case where 'len' is non-negative, usb_string func is terminating the buf with 0. Fix this by removing the termination of buf with '0' in the caller function. Change-Id: Ie32d395b0fc91d6c3e1cfdbafb76304e21e40577 Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
This commit is contained in:
parent
6d08baec31
commit
d7a59889eb
1 changed files with 0 additions and 1 deletions
|
@ -215,7 +215,6 @@ static int snd_usb_copy_string_desc(struct mixer_build *state,
|
|||
int index, char *buf, int maxlen)
|
||||
{
|
||||
int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
|
||||
buf[len] = 0;
|
||||
return len;
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Reference in a new issue