ucm: fix the possible buffer overflow (substitution)

Signed-off-by: Jaroslav Kysela <perex@perex.cz>

diff --git a/src/ucm/ucm_subs.c b/src/ucm/ucm_subs.c
index e6af502..293426f 100644 (file)
--- a/src/ucm/ucm_subs.c
+++ b/src/ucm/ucm_subs.c
@@ -334,7 +334,7 @@ __match2:
                tmp = strchr(value + idsize, '}');
                if (tmp) {
                        rvalsize = tmp - (value + idsize);
-                       if (rvalsize > sizeof(v2)) {
+                       if (rvalsize >= sizeof(v2)) {
                                err = -ENOMEM;
                                goto __error;
                        }