Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18cb7109 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: hda - Check strcpy length 



Check the length to copy via strlen() beforehand to avoid the stack
corruption, or use strlcpy() to be safe in HD-audio codes.

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 4e01f54b

sound/pci/hda/hda_codec.c

+2 −0
Original line number Diff line number Diff line
@@ -1431,6 +1431,8 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec, 
	memset(&id, 0, sizeof(id));

	id.iface = SNDRV_CTL_ELEM_IFACE_MIXER;

	id.index = idx;

	if (snd_BUG_ON(strlen(name) >= sizeof(id.name)))

		return NULL;

	strcpy(id.name, name);

	return snd_ctl_find_id(codec->bus->card, &id);

}

sound/pci/hda/hda_intel.c

+6 −4
Original line number Diff line number Diff line
@@ -1830,7 +1830,7 @@ azx_attach_pcm_stream(struct hda_bus *bus, struct hda_codec *codec, 
			  &pcm);

	if (err < 0)

		return err;

	strcpy(pcm->name, cpcm->name);

	strlcpy(pcm->name, cpcm->name, sizeof(pcm->name));

	apcm = kzalloc(sizeof(*apcm), GFP_KERNEL);

	if (apcm == NULL)

		return -ENOMEM;
@@ -2358,8 +2358,10 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci, 
	}



	strcpy(card->driver, "HDA-Intel");

	strcpy(card->shortname, driver_short_names[chip->driver_type]);

	sprintf(card->longname, "%s at 0x%lx irq %i",

	strlcpy(card->shortname, driver_short_names[chip->driver_type],

		sizeof(card->shortname));

	snprintf(card->longname, sizeof(card->longname),

		 "%s at 0x%lx irq %i",

		 card->shortname, chip->addr, chip->irq);



	*rchip = chip;