Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-08 14:13:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ALSA: opti9xx: fix format string overflow warning

Browse Source 
We pass a long name from "codec->pcm->name" into the longname
string of the same length:

sound/isa/opti9xx/miro.c: In function 'snd_miro_probe':
sound/isa/opti9xx/miro.c:1356:39: error: '%s' directive writing up to 79 bytes into a region of size between 35 and 72 [-Werror=format-overflow=]
  sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d",
                                       ^~
sound/isa/opti9xx/miro.c:1356:26: note: using the range [0, 4294967295] for directive argument
  sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d",
                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sound/isa/opti9xx/miro.c:1356:2: note: 'sprintf' output between 32 and 185 bytes into a destination of size 80
  sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d",

There is no easy way to avoid the theoretical overflow in this case,
but using snprintf() will turn it into a harmless truncation.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Arnd Bergmann 2017-07-18 13:48:07 +02:00 committed by Takashi Iwai
parent 003d3e70db
commit 24d2207731
2 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sound/isa/opti9xx/miro.c
View File

@ -1353,9 +1353,10 @@ static int snd_miro_probe(struct snd_card *card)
} }
strcpy(card->driver, "miro"); strcpy(card->driver, "miro");
sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d", snprintf(card->longname, sizeof(card->longname),
card->shortname, miro->name, codec->pcm->name, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d",
miro->wss_base + 4, miro->irq, miro->dma1, miro->dma2); card->shortname, miro->name, codec->pcm->name,
miro->wss_base + 4, miro->irq, miro->dma1, miro->dma2);
if (mpu_port <= 0 || mpu_port == SNDRV_AUTO_PORT) if (mpu_port <= 0 || mpu_port == SNDRV_AUTO_PORT)
rmidi = NULL; rmidi = NULL;

14
sound/isa/opti9xx/opti92x-ad1848.c
View File

@ -879,13 +879,15 @@ static int snd_opti9xx_probe(struct snd_card *card)
strcpy(card->driver, chip->name); strcpy(card->driver, chip->name);
sprintf(card->shortname, "OPTi %s", card->driver); sprintf(card->shortname, "OPTi %s", card->driver);
#if defined(CS4231) || defined(OPTi93X) #if defined(CS4231) || defined(OPTi93X)
sprintf(card->longname, "%s, %s at 0x%lx, irq %d, dma %d&%d", snprintf(card->longname, sizeof(card->longname),
card->shortname, codec->pcm->name, "%s, %s at 0x%lx, irq %d, dma %d&%d",
chip->wss_base + 4, irq, dma1, xdma2); card->shortname, codec->pcm->name,
chip->wss_base + 4, irq, dma1, xdma2);
#else #else
sprintf(card->longname, "%s, %s at 0x%lx, irq %d, dma %d", snprintf(card->longname, sizeof(card->longname),
card->shortname, codec->pcm->name, chip->wss_base + 4, irq, "%s, %s at 0x%lx, irq %d, dma %d",
dma1); card->shortname, codec->pcm->name, chip->wss_base + 4, irq,
dma1);
#endif /* CS4231 || OPTi93X */ #endif /* CS4231 || OPTi93X */
if (mpu_port <= 0 || mpu_port == SNDRV_AUTO_PORT) if (mpu_port <= 0 || mpu_port == SNDRV_AUTO_PORT)