From d7a59889eb3fae98a75f02a61a35b24a136f84dd Mon Sep 17 00:00:00 2001 From: Ajay Agarwal Date: Tue, 17 Oct 2017 11:28:17 +0530 Subject: [PATCH] ALSA: usb-audio: Add length check after string desc copy It might be possible that negative error code is returned in 'len', when we try to copy USB string desc into the ID name buf of snd_kcontrol instance. But even in that case, we are terminating buf with 0 at the 'len' index, which leads to memory corruption. And for good case where 'len' is non-negative, usb_string func is terminating the buf with 0. Fix this by removing the termination of buf with '0' in the caller function. Change-Id: Ie32d395b0fc91d6c3e1cfdbafb76304e21e40577 Signed-off-by: Ajay Agarwal --- sound/usb/mixer.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index ad139d45f5b2..b62cc921695a 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -215,7 +215,6 @@ static int snd_usb_copy_string_desc(struct mixer_build *state, int index, char *buf, int maxlen) { int len = usb_string(state->chip->dev, index, buf, maxlen - 1); - buf[len] = 0; return len; }