From: Jaroslav Kysela <perex@perex.cz>
Date: Sun, 30 Aug 2026 18:20:30 +0000 (+0200)
Subject: control: ctlparse - another fix for one-byte overrrun in __snd_ctl_ascii_elem_id_parse
X-Git-Url: https://git.alsa-project.org/?a=commitdiff_plain;h=f84cd4ced7b36fddb8e4ee24404cf7c091d27020;p=alsa-lib.git

control: ctlparse - another fix for one-byte overrrun in __snd_ctl_ascii_elem_id_parse

Follows 1e27d63ef6d1dcf7d1f1a1e1eca3ea779e7de377 .

Link: https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/
Reported-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
---

diff --git a/src/control/ctlparse.c b/src/control/ctlparse.c
index c40de2bd..7132210e 100644
--- a/src/control/ctlparse.c
+++ b/src/control/ctlparse.c
@@ -219,7 +219,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str,
 			if (*str == '\'' || *str == '\"') {
 				c = *str++;
 				while (*str && *str != c) {
-					if (size < (int)sizeof(buf)) {
+					if (size < (int)sizeof(buf) - 1) {
 						*ptr++ = *str;
 						size++;
 					}
@@ -229,7 +229,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str,
 					str++;
 			} else {
 				while (*str && *str != ',') {
-					if (size < (int)sizeof(buf)) {
+					if (size < (int)sizeof(buf) - 1) {
 						*ptr++ = *str;
 						size++;
 					}