sound: oss: use strlcpy() in sound_timer_init()
Subsystems (2)
PATCH 1/1 sound: oss: use strlcpy() in sound_timer_init()
sound_timer.info.name is a 32 character buffer. This function only has one caller (in sound/oss/ad1848.c) and it passes as 128 character buffer as "name". I don't know if this is a problem in real life, and I doubt we're going to add more OSS drivers so it's unlikely to become an issue. But we may as well take care of it.
sound/oss/sound_timer.c +1 -1
@@ -320,7 +320,7 @@ void sound_timer_init(struct sound_lowlev_timer *t, char *name) n =sound_alloc_timerdev ();if (n =-1 ) n =0 ;/* Overwrite the system timer */ -strcpy (sound_timer.info.name, name); +strlcpy (sound_timer.info.name, name,sizeof (sound_timer.info.name)); sound_timer_devs[n] = &sound_timer; }EXPORT_SYMBOL (sound_timer_init);
At Thu, 29 Sep 2011 09:10:48 +0300,
Quoted 8 lines · Dan Carpenter
sound_timer.info.name is a 32 character buffer. This function only has one caller (in
sound/oss/ad1848.c) and it passes as 128 character buffer as "name". I don't know if this is a problem in real life, and I doubt we're going to add more OSS drivers so it's unlikely to become an issue. But we may as well take care of it.Signed-off-by Dan Carpenter <[email protected]>
Applied now. Thanks.
Takashi
Quoted 14 lines
sound/oss/sound_timer.c +1
-1@@ -320,7 +320,7 @@ void sound_timer_init(struct sound_lowlev_timer *t, char *name) n =sound_alloc_timerdev ();if (n =-1 ) n =0 ;/* Overwrite the system timer */ -strcpy (sound_timer.info.name, name); +strlcpy (sound_timer.info.name, name,sizeof (sound_timer.info.name)); sound_timer_devs[n] = &sound_timer; }EXPORT_SYMBOL (sound_timer_init);