Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ALSA: ad1848: fix format string overflow warning

The snd_pcm name is too long to fit into the card shortname
or a part of the longname:

sound/isa/ad1848/ad1848.c: In function 'snd_ad1848_probe':
sound/isa/ad1848/ad1848.c:116:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=]
sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sound/isa/ad1848/ad1848.c:116:2: note: 'sprintf' output between 22 and 128 bytes into a destination of size 80
sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
chip->pcm->name, chip->port, irq[n], dma1[n]);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This changes the code to use length-checking functions that truncate
if necessary. The "[Thinkpad]" substring is now also part of the
snprintf(), as that could also overflow the buffer.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

authored by

Arnd Bergmann and committed by
Takashi Iwai
003d3e70 6d8b04de

+10 -6
+10 -6
sound/isa/ad1848/ad1848.c
··· 110 110 if (error < 0) 111 111 goto out; 112 112 113 - strcpy(card->driver, "AD1848"); 114 - strcpy(card->shortname, chip->pcm->name); 113 + strlcpy(card->driver, "AD1848", sizeof(card->driver)); 114 + strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname)); 115 115 116 - sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", 117 - chip->pcm->name, chip->port, irq[n], dma1[n]); 118 - if (thinkpad[n]) 119 - strcat(card->longname, " [Thinkpad]"); 116 + if (!thinkpad[n]) 117 + snprintf(card->longname, sizeof(card->longname), 118 + "%s at 0x%lx, irq %d, dma %d", 119 + chip->pcm->name, chip->port, irq[n], dma1[n]); 120 + else 121 + snprintf(card->longname, sizeof(card->longname), 122 + "%s at 0x%lx, irq %d, dma %d [Thinkpad]", 123 + chip->pcm->name, chip->port, irq[n], dma1[n]); 120 124 121 125 error = snd_card_register(card); 122 126 if (error < 0)