control: ctlparse - another fix for one-byte overrrun in __snd_ctl_ascii_elem_id_parse

Follows 1e27d63ef6d1dcf7d1f1a1e1eca3ea779e7de377 .

Link: https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/
Reported-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/src/control/ctlparse.c b/src/control/ctlparse.c
index c40de2bd28e559bec6a526f8dbef5587886ed50a..7132210e255fb432a731ce953a53e0cafc55f467 100644 (file)
--- a/src/control/ctlparse.c
+++ b/src/control/ctlparse.c
@@ -219,7 +219,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str,
                        if (*str == '\'' || *str == '\"') {
                                c = *str++;
                                while (*str && *str != c) {
-                                       if (size < (int)sizeof(buf)) {
+                                       if (size < (int)sizeof(buf) - 1) {
                                                *ptr++ = *str;
                                                size++;
                                        }
@@ -229,7 +229,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str,
                                        str++;
                        } else {
                                while (*str && *str != ',') {
-                                       if (size < (int)sizeof(buf)) {
+                                       if (size < (int)sizeof(buf) - 1) {
                                                *ptr++ = *str;
                                                size++;
                                        }