DragonFlyBSD Kernel Audit
DF-2333 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/bus/u4b/audio/uaudio.c b/sys/bus/u4b/audio/uaudio.c
--- a/sys/bus/u4b/audio/uaudio.c
+++ b/sys/bus/u4b/audio/uaudio.c
@@ -3998,7 +3998,8 @@
 		break;
 
 	case UDESCSUB_AC_FEATURE:
-		len += sizeof(*u.fu) + 1;
+		/* Need room for bmaControls[0] (4 bytes) + iFeature (1). */
+		len += sizeof(*u.fu) + 4 + 1;
 		break;
 
 	case UDESCSUB_AC_EFFECT: