From patchwork Tue Jul 18 11:48:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 108114 Delivered-To: patch@linaro.org Received: by 10.140.101.44 with SMTP id t41csp5807203qge; Tue, 18 Jul 2017 04:48:53 -0700 (PDT) X-Received: by 10.28.94.201 with SMTP id s192mr1531610wmb.100.1500378533643; Tue, 18 Jul 2017 04:48:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1500378533; cv=none; d=google.com; s=arc-20160816; b=uHMjGaGSwBLyhnUw5p1QFwDsLoojYUH+XiCeebp9bb+fB79SEcZQinb1RbVpM2lq0M EFZD8KpfRRfj9Kho2w30Dc9AXRcx8dCYq0TZEsT50adSOiTVm9P+iAVQXmjv5Ep1yqae rTmi3fbTtf3SgGIljEU8csK6SN5cn1tIF/rcf2jeRCU4rm75EQlzEhl0u91m2KCXFYBJ DcSGNUOpP0tIRBh0M9BPaggkuYplIYxc7yIE9hWmEOvX1YGDIP2QELili7VFThdb3BFA +bLj750RaMJPwRESngk4gFE7wy1HPvrhn+T/0wFZBsOPocv63IZGd7Mb40X8gAeT73LV 8eTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:cc:references:in-reply-to:message-id :date:to:from:delivered-to:arc-authentication-results; bh=MQ7RXxlXfTQ7jL0uzod7kfWatxJ4uP4geGiDHKrcQgU=; b=flaX/S927ErDfL//n+UA167fLSVRpUjc5pQDBUdXkrpE8onRIACEk4ksZ1n4unFUIh xAOsK6gJafo07lB6gKAfkKQGhT9HAAjYFpfvdr6fLWuiD/AqrpR+fzfeA4qnlV3bGbX2 k44EE3zF4bwXVLJ2QTWHFX6MGB4OjUhGLh0d7NhrXk3Od0fx9LEt9aOmawJcjRBTFGPM MNxqpHcZrqn4sDHFlyOOVrY7C/C0GKBO7eToJvVRS+KS8TVJGknz6Qr5S6z4WAxaGk9q HAzb0ijzpx/PAW5mxiCYf7jweSbHTHG7ZfjPvzWNcNPMT9GS6/ANdCVe1KrpzCe2UJ+1 b6Iw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of alsa-devel-bounces@alsa-project.org designates 77.48.224.243 as permitted sender) smtp.mailfrom=alsa-devel-bounces@alsa-project.org Return-Path: Received: from alsa0.perex.cz (alsa0.perex.cz. [77.48.224.243]) by mx.google.com with ESMTP id g10si1576397wrc.359.2017.07.18.04.48.53; Tue, 18 Jul 2017 04:48:53 -0700 (PDT) Received-SPF: pass (google.com: domain of alsa-devel-bounces@alsa-project.org designates 77.48.224.243 as permitted sender) client-ip=77.48.224.243; Authentication-Results: mx.google.com; spf=pass (google.com: domain of alsa-devel-bounces@alsa-project.org designates 77.48.224.243 as permitted sender) smtp.mailfrom=alsa-devel-bounces@alsa-project.org Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id C723C267121; Tue, 18 Jul 2017 13:48:51 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 33D8A267176; Tue, 18 Jul 2017 13:48:51 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mail1.perex.cz X-Spam-Level: X-Spam-Status: No, score=-2.3 required=5.0 tests=RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, RCVD_IN_SORBS_SPAM, URIBL_BLOCKED autolearn=disabled version=3.4.0 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.134]) by alsa0.perex.cz (Postfix) with ESMTP id 6F9FB2664EB for ; Tue, 18 Jul 2017 13:48:49 +0200 (CEST) Received: from wuerfel.lan ([5.56.224.194]) by mrelayeu.kundenserver.de (mreue005 [212.227.15.129]) with ESMTPA (Nemesis) id 0M9tYC-1dMPRb3cAy-00B7P8; Tue, 18 Jul 2017 13:48:43 +0200 From: Arnd Bergmann To: Jaroslav Kysela , Takashi Iwai Date: Tue, 18 Jul 2017 13:48:05 +0200 Message-Id: <20170718114820.3681255-2-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20170718114820.3681255-1-arnd@arndb.de> References: <20170718114820.3681255-1-arnd@arndb.de> X-Provags-ID: V03:K0:R5homueT0h4VvUv3QB93gLIODbEMuAoZ6esebcSjhcjdAyz/4ez HLczXqhM62Wx30L6TpY7RbI9ywGaO98cGLs/nQhOsS5AQQMHxBruSxYHiTlzd72zl/G0y42 9i9+Vl09UEGmdx+tyvJipyS60H9j1RVE9v5Brc/KWyeU/VurThnNIbSl4CoZvGrPCqT2Zc4 86NtOt9D496CAnuRigMCA== X-UI-Out-Filterresults: notjunk:1; V01:K0:3GDTuhKk+0w=:IOxYeHnIf51F7qPsaAZEA/ BRv9ZDO8B6Hzw1Zp5xHkIJL1Z/9GrupKx/R501Rll7BE7yFULpYwq6lGuuEP5uWwXKkVCDiEg 1svMB5FphXgNtw9tut360zX/ryF9iUvSZ0h33ahRhbGoxeueps+XF5HNjffNhFqnWZYE5u+00 iA4Ik/RZ9AhkRGTqqusgYMcfKqP2VSfyWEmMM59U5oCkZVkLjU+7uuKt2xGHDhXsXUUgAKggU mvsk8/Vxzfb34/nGxfOQU1QWeNocu09dkg/rD6/Te7Kcg5ftjzuOaG9i+OCqT07MFYKjziENB cTpT01phryr4grBYEijrBAVyimdUNIvQjRlsUcTZcqw2l1RY0cELtZq2A2WxGTCMR+PJh8Q1o MQO/8hYBaXRAkpqSrXdOglhHOynW9PCZ9iBX70sRCjluk2qTB50i8zScoZTC8ZBXHux+03p2L gVgMPvZhiAsrF5UyGyO4Op80ckGcVF+2PtgKBQUnjPkM4MnK76szjeR8CSnsSf8hggvP4vu1i kqCb72GXZAMlRE6VC2++AbxSpl6eOaNWyIPeiHi6CbCmOotW69I+Pv0t7HLfgcLe94F58dBeQ SBo4j48IFVXkF9vtPzsdHI2ZZzT9TaIg3f5yDszkbcDrpnYC9GuIwmvs8dzlUuWvNvK8QE3Wx RFhsKvY6s0mSqViO1AwB0KWqetRAyZBWTsA/3/4zYSgOztLuEW/OpJ/X9sYfYokAVBalVYeUP MRGTs/8MSPVYyBcxqWdKZnwnGmGVhKIuV2xgyw== Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Arnd Bergmann Subject: [alsa-devel] [PATCH v2 2/7] ALSA: cs423x: fix format string overflow warning X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org The snd_pcm name may overflow the card->longname total size: sound/isa/cs423x/cs4231.c: In function 'snd_cs4231_probe': sound/isa/cs423x/cs4231.c:115:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=] 0x%lx, irq %d, dma %d", sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This changes the driver to use snprintf() so we truncate the string instead of overflowing into the next field if that happens. I decided to split out the second format string for the extra DMA channel to keep the code simpler. Signed-off-by: Arnd Bergmann --- sound/isa/cs423x/cs4231.c | 18 +++++++++++------- sound/isa/cs423x/cs4236.c | 20 +++++++++++--------- 2 files changed, 22 insertions(+), 16 deletions(-) -- 2.9.0 _______________________________________________ Alsa-devel mailing list Alsa-devel@alsa-project.org http://mailman.alsa-project.org/mailman/listinfo/alsa-devel diff --git a/sound/isa/cs423x/cs4231.c b/sound/isa/cs423x/cs4231.c index e8edd9017a2f..d90ab9558f7f 100644 --- a/sound/isa/cs423x/cs4231.c +++ b/sound/isa/cs423x/cs4231.c @@ -109,13 +109,17 @@ static int snd_cs4231_probe(struct device *dev, unsigned int n) if (error < 0) goto out; - strcpy(card->driver, "CS4231"); - strcpy(card->shortname, chip->pcm->name); - - sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", - chip->pcm->name, chip->port, irq[n], dma1[n]); - if (dma2[n] >= 0) - sprintf(card->longname + strlen(card->longname), "&%d", dma2[n]); + strlcpy(card->driver, "CS4231", sizeof(card->driver)); + strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname)); + + if (dma2[n] < 0) + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %d, dma %d", + chip->pcm->name, chip->port, irq[n], dma1[n]); + else + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %d, dma %d&%d", + chip->pcm->name, chip->port, irq[n], dma1[n], dma2[n]); error = snd_wss_mixer(chip); if (error < 0) diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c index 1f9a3b2be7a1..4c09756c7353 100644 --- a/sound/isa/cs423x/cs4236.c +++ b/sound/isa/cs423x/cs4236.c @@ -419,15 +419,17 @@ static int snd_cs423x_probe(struct snd_card *card, int dev) if (err < 0) return err; } - strcpy(card->driver, chip->pcm->name); - strcpy(card->shortname, chip->pcm->name); - sprintf(card->longname, "%s at 0x%lx, irq %i, dma %i", - chip->pcm->name, - chip->port, - irq[dev], - dma1[dev]); - if (dma2[dev] >= 0) - sprintf(card->longname + strlen(card->longname), "&%d", dma2[dev]); + strlcpy(card->driver, chip->pcm->name, sizeof(card->driver)); + strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname)); + if (dma2[dev] < 0) + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %i, dma %i", + chip->pcm->name, chip->port, irq[dev], dma1[dev]); + else + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %i, dma %i&%d", + chip->pcm->name, chip->port, irq[dev], dma1[dev], + dma2[dev]); err = snd_wss_timer(chip, 0); if (err < 0)