ALSA: usb-audio: Fix out-of-bound error

Commit Message

Takashi Iwai Nov. 15, 2017, 9:16 a.m. UTC

On Wed, 15 Nov 2017 09:57:56 +0100,
Jaejoong Kim wrote:
> 
> diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
> index e630813..5a83c2c 100644
> --- a/sound/usb/mixer.c
> +++ b/sound/usb/mixer.c
> @@ -204,7 +204,8 @@ static int snd_usb_copy_string_desc(struct mixer_build
> *state,
>                                     int index, char *buf, int maxlen)
>  {
>         int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
> -       buf[len] = 0;
> +       if (len > 0)
> +               buf[len] = 0;
>         return len;

I'd rather put an explicit error bail-out, i.e.



thanks,

Takashi

Comments

Jaejoong Kim Nov. 16, 2017, 12:42 a.m. UTC | #1

Hi, Takashi

2017-11-15 18:16 GMT+09:00 Takashi Iwai <[e-mail]>:
> On Wed, 15 Nov 2017 09:57:56 +0100,
> Jaejoong Kim wrote:
>>
>> diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
>> index e630813..5a83c2c 100644
>> --- a/sound/usb/mixer.c
>> +++ b/sound/usb/mixer.c
>> @@ -204,7 +204,8 @@ static int snd_usb_copy_string_desc(struct mixer_build
>> *state,
>>                                     int index, char *buf, int maxlen)
>>  {
>>         int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
>> -       buf[len] = 0;
>> +       if (len > 0)
>> +               buf[len] = 0;
>>         return len;
>
> I'd rather put an explicit error bail-out, i.e.
>
> diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
> index 91bc8f18791e..296a63a9d09c 100644
> --- a/sound/usb/mixer.c
> +++ b/sound/usb/mixer.c
> @@ -204,6 +204,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state,
>                                     int index, char *buf, int maxlen)
>  {
>         int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
> +
> +       if (len < 0)
> +               return len;
> +
>         buf[len] = 0;
>         return len;
>  }

OK.

I will resend v2 patch with your suggestion.

>
>
> thanks,
>
> Takashi

thanks,
Jaejoong

Patch

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 91bc8f18791e..296a63a9d09c 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -204,6 +204,10 @@  static int snd_usb_copy_string_desc(struct mixer_build *state,
 				    int index, char *buf, int maxlen)
 {
 	int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
+
+	if (len < 0)
+		return len;
+
 	buf[len] = 0;
 	return len;
 }