From ad1fa22196f0b0e9f91303e8c96e9d210c104ccb Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Thu, 27 Apr 2017 12:02:11 +1000 Subject: [PATCH] hidpp10: fix out-of-bounds access sizeof() gives us twice as many elements as we have indices for on this 16-bit array. Signed-off-by: Peter Hutterer --- src/hidpp10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hidpp10.c b/src/hidpp10.c index 73ef425d..3de888d5 100644 --- a/src/hidpp10.c +++ b/src/hidpp10.c @@ -1397,7 +1397,7 @@ hidpp10_profile_set_names(struct hidpp10_device *dev, struct hidpp10_profile *pr memcpy(metadata->lgs02.marker, "LGS02", sizeof(metadata->lgs02.marker)); hidpp10_uchar8_to_uchar16(metadata->lgs02.name, profile->name, - sizeof(metadata->lgs02.name)); + ARRAY_LENGTH(metadata->lgs02.name)); for (i = 0; i < ARRAY_LENGTH(metadata->lgs02.macro_names); i++) { hidpp10_uchar8_to_uchar16(metadata->lgs02.macro_names[i], profile->macro_names[i],