lkml.org 
[lkml]   [2015]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13.y-ckt 020/122] ALSA: emu10k1: Fix card shortname string buffer overflow
    Date
    3.13.11-ckt22 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>

    commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream.

    Some models provide too long string for the shortname that has 32bytes
    including the terminator, and it results in a non-terminated string
    exposed to the user-space. This isn't too critical, though, as the
    string is stopped at the succeeding longname string.

    This patch fixes such entries by dropping "SB" prefix (it's enough to
    fit within 32 bytes, so far). Meanwhile, it also changes strcpy()
    with strlcpy() to make sure that this kind of problem won't happen in
    future, too.

    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    sound/pci/emu10k1/emu10k1.c | 6 ++++--
    sound/pci/emu10k1/emu10k1_main.c | 4 ++--
    2 files changed, 6 insertions(+), 4 deletions(-)

    diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
    index 9e1bd0c..6757458 100644
    --- a/sound/pci/emu10k1/emu10k1.c
    +++ b/sound/pci/emu10k1/emu10k1.c
    @@ -181,8 +181,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci,
    }
    #endif

    - strcpy(card->driver, emu->card_capabilities->driver);
    - strcpy(card->shortname, emu->card_capabilities->name);
    + strlcpy(card->driver, emu->card_capabilities->driver,
    + sizeof(card->driver));
    + strlcpy(card->shortname, emu->card_capabilities->name,
    + sizeof(card->shortname));
    snprintf(card->longname, sizeof(card->longname),
    "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
    card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
    diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
    index bdd888e..134b7cf 100644
    --- a/sound/pci/emu10k1/emu10k1_main.c
    +++ b/sound/pci/emu10k1/emu10k1_main.c
    @@ -1411,7 +1411,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
    *
    */
    {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
    - .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
    + .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
    .id = "Audigy2",
    .emu10k2_chip = 1,
    .ca0108_chip = 1,
    @@ -1561,7 +1561,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
    .adc_1361t = 1, /* 24 bit capture instead of 16bit */
    .ac97_chip = 1} ,
    {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
    - .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
    + .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
    .id = "Audigy2",
    .emu10k2_chip = 1,
    .ca0102_chip = 1,
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-06-18 01:21    [W:7.127 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site