Messages in this thread | | | Date | Fri, 28 Jul 2023 09:25:24 +0200 | Subject | Re: [PATCH] ASoC: Intel: Skylake: replace deprecated strncpy with strscpy | From | Amadeusz Sławiński <> |
| |
On 7/27/2023 12:34 AM, Kees Cook wrote: > On Wed, Jul 26, 2023 at 09:12:18PM +0000, justinstitt@google.com wrote: >> `strncpy` is deprecated for use on NUL-terminated destination strings [1]. >> >> A suitable replacement is `strscpy` [2] due to the fact that it >> guarantees NUL-termination on its destination buffer argument which is >> _not_ the case for `strncpy`! >> >> It was pretty difficult, in this case, to try and figure out whether or >> not the destination buffer was zero-initialized. If it is and this >> behavior is relied on then perhaps `strscpy_pad` is the preferred >> option here. >> >> Kees was able to help me out and identify the following code snippet >> which seems to show that the destination buffer is zero-initialized. >> >> | skl = devm_kzalloc(&pci->dev, sizeof(*skl), GFP_KERNEL); >> >> With this information, I opted for `strscpy` since padding is seemingly >> not required. > > We did notice that str_elem->string is 44 bytes, but > skl->lib_info[ref_count].name is 128 bytes. If str_elem->string isn't > NUL-terminated, this can still hit an over-read condition (though > CONFIG_FORTIFY_SOURCE would have caught it both before with strncpy() > and now with strscpy()). So I assume it is expected to be > NUL-terminated? >
Yes it is a filename of additional library which can be loaded, topology UAPI only allows for passing 44 bytes long strings per string token (see snd_soc_tplg_vendor_array -> union -> string flex array -> snd_soc_tplg_vendor_string_elem -> SNDRV_CTL_ELEM_ID_NAME_MAXLEN), so we could also change length of skl->lib_info[ref_count].name and potentially save few bytes. And looking at it again I also think that we should not copy destination size number of bytes, by which I mean ARRAY_SIZE(skl->lib_info[ref_count].name), which is 128 in this case... so either need to change destination buffer size to be same as topology field or calculate it differently.
| |