Skip to contentSkip to conversation

sound: oss: use strlcpy() in sound_timer_init()

PATCH In review Dan Carpenter 2 participants 2 messages Sep 29, 2011

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 sound: oss: use strlcpy() in sound_timer_init()

sound_timer.info.name is a 32 character buffer. This function only has one caller (in sound/oss/ad1848.c) and it passes as 128 character buffer as "name". I don't know if this is a problem in real life, and I doubt we're going to add more OSS drivers so it's unlikely to become an issue. But we may as well take care of it.

sound/oss/sound_timer.c +1 -1
index 48cda6c..8021c85 100644
@@ -320,7 +320,7 @@ void  sound_timer_init(struct sound_lowlev_timer *t, char *name)
 	n = sound_alloc_timerdev();
 	if (n = -1)
 		n = 0;		/* Overwrite the system timer */
-	strcpy(sound_timer.info.name, name);
+	strlcpy(sound_timer.info.name, name, sizeof(sound_timer.info.name));
 	sound_timer_devs[n] = &sound_timer;
 }
 EXPORT_SYMBOL(sound_timer_init);
#1 lore raw

At Thu, 29 Sep 2011 09:10:48 +0300,

Quoted 8 lines · Dan Carpenter

sound_timer.info.name is a 32 character buffer. This function only has one caller (in sound/oss/ad1848.c) and it passes as 128 character buffer as "name". I don't know if this is a problem in real life, and I doubt we're going to add more OSS drivers so it's unlikely to become an issue. But we may as well take care of it.

Applied now. Thanks.

Takashi

Quoted 14 lines
sound/oss/sound_timer.c +1 -1
index 48cda6c..8021c85 100644
@@ -320,7 +320,7 @@ void  sound_timer_init(struct sound_lowlev_timer *t, char *name)
 	n = sound_alloc_timerdev();
 	if (n = -1)
 		n = 0;		/* Overwrite the system timer */
-	strcpy(sound_timer.info.name, name);
+	strlcpy(sound_timer.info.name, name, sizeof(sound_timer.info.name));
 	sound_timer_devs[n] = &sound_timer;
 }
 EXPORT_SYMBOL(sound_timer_init);