summaryrefslogtreecommitdiff
path: root/sound/drivers
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-06-21 16:25:33 +0400
committerTakashi Iwai <tiwai@suse.de>2013-06-21 16:32:06 +0400
commitfefe228c5f13809f77e6b2873ffe8bfb006cadd4 (patch)
tree94e9ef2b69f5c3f51ff8479a3ce60e93ce8e1892 /sound/drivers
parent88d5760649d9024a2a68e649909f522ab42d891c (diff)
downloadlinux-fefe228c5f13809f77e6b2873ffe8bfb006cadd4.tar.xz
ALSA: vx_core: off by one in vx_read_status()
This code is older than git, and I haven't tested it, but if size == SIZE_MAX_STATUS then we would write one space past the end of the rmh->Stat[] array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/drivers')
-rw-r--r--sound/drivers/vx/vx_core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/drivers/vx/vx_core.c b/sound/drivers/vx/vx_core.c
index c39961c11401..83596891cde4 100644
--- a/sound/drivers/vx/vx_core.c
+++ b/sound/drivers/vx/vx_core.c
@@ -205,7 +205,7 @@ static int vx_read_status(struct vx_core *chip, struct vx_rmh *rmh)
if (size < 1)
return 0;
- if (snd_BUG_ON(size > SIZE_MAX_STATUS))
+ if (snd_BUG_ON(size >= SIZE_MAX_STATUS))
return -EINVAL;
for (i = 1; i <= size; i++) {