Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-22 20:22:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: cs423x: fix format string overflow warning

Browse Source 
The snd_pcm name may overflow the card->longname total size:

sound/isa/cs423x/cs4231.c: In function 'snd_cs4231_probe':
sound/isa/cs423x/cs4231.c:115:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=] 0x%lx, irq %d, dma %d",
  sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This changes the driver to use snprintf() so we truncate the string
instead of overflowing into the next field if that happens.

I decided to split out the second format string for the extra
DMA channel to keep the code simpler.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Arnd Bergmann 2017-07-18 13:48:05 +02:00 committed by Takashi Iwai
parent 8a463639db
commit 6d8b04de87
2 changed files with 21 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sound/isa/cs423x/cs4231.c
View File

@ -109,13 +109,17 @@ static int snd_cs4231_probe(struct device *dev, unsigned int n)
if (error < 0) if (error < 0)
goto out; goto out;
strcpy(card->driver, "CS4231"); strlcpy(card->driver, "CS4231", sizeof(card->driver));
strcpy(card->shortname, chip->pcm->name); strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname));
sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", if (dma2[n] < 0)
chip->pcm->name, chip->port, irq[n], dma1[n]); snprintf(card->longname, sizeof(card->longname),
if (dma2[n] >= 0) "%s at 0x%lx, irq %d, dma %d",
sprintf(card->longname + strlen(card->longname), "&%d", dma2[n]); chip->pcm->name, chip->port, irq[n], dma1[n]);
else
snprintf(card->longname, sizeof(card->longname),
"%s at 0x%lx, irq %d, dma %d&%d",
chip->pcm->name, chip->port, irq[n], dma1[n], dma2[n]);
error = snd_wss_mixer(chip); error = snd_wss_mixer(chip);
if (error < 0) if (error < 0)

20
sound/isa/cs423x/cs4236.c
View File

@ -419,15 +419,17 @@ static int snd_cs423x_probe(struct snd_card *card, int dev)
if (err < 0) if (err < 0)
return err; return err;
} }
strcpy(card->driver, chip->pcm->name); strlcpy(card->driver, chip->pcm->name, sizeof(card->driver));
strcpy(card->shortname, chip->pcm->name); strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname));
sprintf(card->longname, "%s at 0x%lx, irq %i, dma %i", if (dma2[dev] < 0)
chip->pcm->name, snprintf(card->longname, sizeof(card->longname),
chip->port, "%s at 0x%lx, irq %i, dma %i",
irq[dev], chip->pcm->name, chip->port, irq[dev], dma1[dev]);
dma1[dev]); else
if (dma2[dev] >= 0) snprintf(card->longname, sizeof(card->longname),
sprintf(card->longname + strlen(card->longname), "&%d", dma2[dev]); "%s at 0x%lx, irq %i, dma %i&%d",
chip->pcm->name, chip->port, irq[dev], dma1[dev],
dma2[dev]);
err = snd_wss_timer(chip, 0); err = snd_wss_timer(chip, 0);
if (err < 0) if (err < 0)