diff options
| author | Mark Brown <broonie@kernel.org> | 2022-08-05 16:24:07 +0200 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2022-08-05 16:24:07 +0200 |
| commit | 5549af7f42916c0d7e78a0e423ac667e27eaac3e (patch) | |
| tree | 6188f9b2f6440c56985c84c006c4d5693898da57 /sound | |
| parent | ASoC: DPCM: Don't pick up BE without substream (diff) | |
| parent | ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() (diff) | |
| download | linux-5549af7f42916c0d7e78a0e423ac667e27eaac3e.tar.xz linux-5549af7f42916c0d7e78a0e423ac667e27eaac3e.zip | |
ASoC: Fix theoretical buffer overflow by snprintf()
Merge series from Takashi Iwai <tiwai@suse.de>:
This is a patch series to paper over the theoretical buffer overflow
that might be caused by snprintf(). snprintf() is notorious for its
behavior and the usage of a safer version, scnprintf(), is
recommended.
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/intel/avs/pcm.c | 4 | ||||
| -rw-r--r-- | sound/soc/sof/debug.c | 6 | ||||
| -rw-r--r-- | sound/soc/sof/intel/hda.c | 2 |
3 files changed, 6 insertions, 6 deletions
diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c index f21b0cdd3206..8fe5917b1e26 100644 --- a/sound/soc/intel/avs/pcm.c +++ b/sound/soc/intel/avs/pcm.c @@ -636,8 +636,8 @@ static ssize_t topology_name_read(struct file *file, char __user *user_buf, size char buf[64]; size_t len; - len = snprintf(buf, sizeof(buf), "%s/%s\n", component->driver->topology_name_prefix, - mach->tplg_filename); + len = scnprintf(buf, sizeof(buf), "%s/%s\n", component->driver->topology_name_prefix, + mach->tplg_filename); return simple_read_from_buffer(user_buf, count, ppos, buf, len); } diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c index c5d797e97c02..d9a3ce7b69e1 100644 --- a/sound/soc/sof/debug.c +++ b/sound/soc/sof/debug.c @@ -252,9 +252,9 @@ static int memory_info_update(struct snd_sof_dev *sdev, char *buf, size_t buff_s } for (i = 0, len = 0; i < reply->num_elems; i++) { - ret = snprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n", - reply->elems[i].zone, reply->elems[i].id, - reply->elems[i].used, reply->elems[i].free); + ret = scnprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n", + reply->elems[i].zone, reply->elems[i].id, + reply->elems[i].used, reply->elems[i].free); if (ret < 0) goto error; len += ret; diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c index 8639ea63a10d..6d4ecbe14adf 100644 --- a/sound/soc/sof/intel/hda.c +++ b/sound/soc/sof/intel/hda.c @@ -574,7 +574,7 @@ static void hda_dsp_dump_ext_rom_status(struct snd_sof_dev *sdev, const char *le chip = get_chip_info(sdev->pdata); for (i = 0; i < HDA_EXT_ROM_STATUS_SIZE; i++) { value = snd_sof_dsp_read(sdev, HDA_DSP_BAR, chip->rom_status_reg + i * 0x4); - len += snprintf(msg + len, sizeof(msg) - len, " 0x%x", value); + len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value); } dev_printk(level, sdev->dev, "extended rom status: %s", msg); |