korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-11 21:14:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: hda - Check strcpy length

Browse Source 
Check the length to copy via strlen() beforehand to avoid the stack
corruption, or use strlcpy() to be safe in HD-audio codes.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2009-04-16 10:22:24 +02:00
parent 4e01f54bfd
commit 18cb7109d3
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sound/pci/hda/hda_codec.c
View File

@ -1431,6 +1431,8 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec,
memset(&id, 0, sizeof(id)); memset(&id, 0, sizeof(id));
id.iface = SNDRV_CTL_ELEM_IFACE_MIXER; id.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
id.index = idx; id.index = idx;
if (snd_BUG_ON(strlen(name) >= sizeof(id.name)))
return NULL;
strcpy(id.name, name); strcpy(id.name, name);
return snd_ctl_find_id(codec->bus->card, &id); return snd_ctl_find_id(codec->bus->card, &id);
} }

8
sound/pci/hda/hda_intel.c
View File

@ -1830,7 +1830,7 @@ azx_attach_pcm_stream(struct hda_bus *bus, struct hda_codec *codec,
&pcm); &pcm);
if (err < 0) if (err < 0)
return err; return err;
strcpy(pcm->name, cpcm->name); strlcpy(pcm->name, cpcm->name, sizeof(pcm->name));
apcm = kzalloc(sizeof(*apcm), GFP_KERNEL); apcm = kzalloc(sizeof(*apcm), GFP_KERNEL);
if (apcm == NULL) if (apcm == NULL)
return -ENOMEM; return -ENOMEM;
@ -2358,8 +2358,10 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
} }
strcpy(card->driver, "HDA-Intel"); strcpy(card->driver, "HDA-Intel");
strcpy(card->shortname, driver_short_names[chip->driver_type]); strlcpy(card->shortname, driver_short_names[chip->driver_type],
sprintf(card->longname, "%s at 0x%lx irq %i", sizeof(card->shortname));
snprintf(card->longname, sizeof(card->longname),
"%s at 0x%lx irq %i",
card->shortname, chip->addr, chip->irq); card->shortname, chip->addr, chip->irq);
*rchip = chip; *rchip = chip;