Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ef76cb7 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by Mauro Carvalho Chehab
Browse files

media: siano: be sure to not override devpath size 



Right now, at siano driver, all places where devpath is
defined has sizeof(devpath) == 32. So, there's no practical
risc of going past devpath array anywhere.

Still, code changes might cause troubles. It also confuses
Coverity:
	CID 139059 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)
	9. fixed_size_dest: You might overrun the 32-character
	   fixed-size string entry->devpath by copying devpath
	   without checking the length.
	10. parameter_as_source: Note: This defect has an
	    elevated risk because the source argument
	    is a parameter of the current function.

So, explicitly limit strcmp() and strcpy() to ensure that the
devpath size (32) will be respected.

Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent e1b7f11b

drivers/media/common/siano/smscoreapi.c

+5 −5
Original line number Diff line number Diff line
@@ -442,7 +442,7 @@ static struct smscore_registry_entry_t *smscore_find_registry(char *devpath) 
	     next != &g_smscore_registry;

	     next = next->next) {

		entry = (struct smscore_registry_entry_t *) next;

		if (!strcmp(entry->devpath, devpath)) {

		if (!strncmp(entry->devpath, devpath, sizeof(entry->devpath))) {

			kmutex_unlock(&g_smscore_registrylock);

			return entry;

		}
@@ -450,7 +450,7 @@ static struct smscore_registry_entry_t *smscore_find_registry(char *devpath) 
	entry = kmalloc(sizeof(*entry), GFP_KERNEL);

	if (entry) {

		entry->mode = default_mode;

		strcpy(entry->devpath, devpath);

		strlcpy(entry->devpath, devpath, sizeof(entry->devpath));

		list_add(&entry->entry, &g_smscore_registry);

	} else

		pr_err("failed to create smscore_registry.\n");
@@ -733,7 +733,7 @@ int smscore_register_device(struct smsdevice_params_t *params, 
	dev->postload_handler = params->postload_handler;



	dev->device_flags = params->flags;

	strcpy(dev->devpath, params->devpath);

	strlcpy(dev->devpath, params->devpath, sizeof(dev->devpath));



	smscore_registry_settype(dev->devpath, params->device_type);