Commit fefe228c authored Jun 21, 2013 by Dan Carpenter Committed by Takashi Iwai Jun 21, 2013

ALSA: vx_core: off by one in vx_read_status()



This code is older than git, and I haven't tested it, but if size ==
SIZE_MAX_STATUS then we would write one space past the end of the
rmh->Stat[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

parent 88d57606

sound/drivers/vx/vx_core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -205,7 +205,7 @@ static int vx_read_status(struct vx_core chip, struct vx_rmh rmh)

		if (size < 1)
		return 0;
		if (snd_BUG_ON(size > SIZE_MAX_STATUS))
		if (snd_BUG_ON(size >= SIZE_MAX_STATUS))
		return -EINVAL;

		for (i = 1; i <= size; i++) {