ALSA: usb-audio: Add length check after string desc copy

It might be possible that negative error code is returned
in 'len', when we try to copy USB string desc into the ID
name buf of snd_kcontrol instance. But even in that case,
we are terminating buf with 0 at the 'len' index, which
leads to memory corruption. And for good case where 'len'
is non-negative, usb_string func is terminating the buf
with 0.

Fix this by removing the termination of buf with '0'
in the caller function.

Change-Id: Ie32d395b0fc91d6c3e1cfdbafb76304e21e40577
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
This commit is contained in:
Ajay Agarwal 2017-10-17 11:28:17 +05:30
parent 6d08baec31
commit d7a59889eb

View file

@ -215,7 +215,6 @@ static int snd_usb_copy_string_desc(struct mixer_build *state,
int index, char *buf, int maxlen)
{
int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
buf[len] = 0;
return len;
}