diff options
| author | Takashi Iwai <tiwai@suse.de> | 2009-04-16 10:22:24 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2009-04-16 10:22:24 +0200 |
| commit | 18cb7109d3e83195b605ff2905981020e86f72ca (patch) | |
| tree | 7db1fa0c6ec8656a0a041bf9163b0656dd4a5765 /sound/pci | |
| parent | ALSA: hda - Add Creative CA0110-IBG support (diff) | |
| download | linux-18cb7109d3e83195b605ff2905981020e86f72ca.tar.xz linux-18cb7109d3e83195b605ff2905981020e86f72ca.zip | |
ALSA: hda - Check strcpy length
Check the length to copy via strlen() beforehand to avoid the stack
corruption, or use strlcpy() to be safe in HD-audio codes.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/pci')
| -rw-r--r-- | sound/pci/hda/hda_codec.c | 2 | ||||
| -rw-r--r-- | sound/pci/hda/hda_intel.c | 10 |
2 files changed, 8 insertions, 4 deletions
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 37f24ce7c3a2..48f0cea7df14 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -1431,6 +1431,8 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec, memset(&id, 0, sizeof(id)); id.iface = SNDRV_CTL_ELEM_IFACE_MIXER; id.index = idx; + if (snd_BUG_ON(strlen(name) >= sizeof(id.name))) + return NULL; strcpy(id.name, name); return snd_ctl_find_id(codec->bus->card, &id); } diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 21a3092fad00..41db5d4da478 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -1830,7 +1830,7 @@ azx_attach_pcm_stream(struct hda_bus *bus, struct hda_codec *codec, &pcm); if (err < 0) return err; - strcpy(pcm->name, cpcm->name); + strlcpy(pcm->name, cpcm->name, sizeof(pcm->name)); apcm = kzalloc(sizeof(*apcm), GFP_KERNEL); if (apcm == NULL) return -ENOMEM; @@ -2358,9 +2358,11 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci, } strcpy(card->driver, "HDA-Intel"); - strcpy(card->shortname, driver_short_names[chip->driver_type]); - sprintf(card->longname, "%s at 0x%lx irq %i", - card->shortname, chip->addr, chip->irq); + strlcpy(card->shortname, driver_short_names[chip->driver_type], + sizeof(card->shortname)); + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx irq %i", + card->shortname, chip->addr, chip->irq); *rchip = chip; return 0; |