From patchwork Tue Jul 18 11:48:06 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 9848125 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 06E1260392 for ; Tue, 18 Jul 2017 11:49:19 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E83182842E for ; Tue, 18 Jul 2017 11:49:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DB0AC26E96; Tue, 18 Jul 2017 11:49:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.4 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_NONE, RCVD_IN_SORBS_SPAM autolearn=no version=3.3.1 Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 25E5726E96 for ; Tue, 18 Jul 2017 11:49:18 +0000 (UTC) Received: from alsa0.perex.cz (localhost [127.0.0.1]) by alsa0.perex.cz (Postfix) with ESMTP id EFD07267192; Tue, 18 Jul 2017 13:49:16 +0200 (CEST) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id BFF4026718D; Tue, 18 Jul 2017 13:49:10 +0200 (CEST) Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.187]) by alsa0.perex.cz (Postfix) with ESMTP id 429F826717C for ; Tue, 18 Jul 2017 13:49:03 +0200 (CEST) Received: from wuerfel.lan ([5.56.224.194]) by mrelayeu.kundenserver.de (mreue005 [212.227.15.129]) with ESMTPA (Nemesis) id 0Lu05i-1dfROB3lHa-011PyW; Tue, 18 Jul 2017 13:48:57 +0200 From: Arnd Bergmann To: Jaroslav Kysela , Takashi Iwai Date: Tue, 18 Jul 2017 13:48:06 +0200 Message-Id: <20170718114820.3681255-3-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20170718114820.3681255-1-arnd@arndb.de> References: <20170718114820.3681255-1-arnd@arndb.de> X-Provags-ID: V03:K0:F9ziNUE2Xup2Gh2Cu+sVE6689W9kFeby51fmcHKadooCwNRi8Vv EfGjq0iYPgwYUBywbKyl/Tl570KzIqwk0Do6UDY7i1jvdZej3lznmP74+WWOrlM8TQIjwfF yA73AULCE9wwj24pwMfZZiLG7yKCZnl+6JNvlcy6ZKhA3Ln6tmLLLUCv1cIMEaFk78HaqHq p16cVivfNsJp29wcsXKAg== X-UI-Out-Filterresults: notjunk:1; V01:K0:i2ysn1W6KPk=:BjegXtfFUf9DI2BxEsCciV KaiLX59LeFmVeSa4YYvC/CDtnVXqYhYYd8plU1aeQVDS1E9Gkf+mPky/PujXeoHtMV0SC9X6h muhqML43OJq5h5z4/5feXInZiAunrvmTgIpaJD3e3Ng7uCAXJLKcQtNL75IdokdbKSV9to/9q 3YB5KnaelyCX8wPZF29h+UuVSfSStUNETu+OKX/ruOzy4ph/ELrcXyOApEVBDDK57AvbyFzhZ GFr4gUNM3YpiVur3Pp2cf2FBn9O0PYg/+YiYdflNunbzzV3ivJZC/4jBb8t/yeL75Q/kUDz8q dvA6lEmalRaqiMafE2pPjFV2AaMVpM4sWsGfT0TTtCpK6sN3Jves5W0O/NaZYGuiy8nFy2Z8H t+mc9aRrPk5JMsPg2zkUNVAh9vRhlYC4nldNTyon1sY1fbpPHY432nH5rf61Pw+1DACo3JCps +kxz0rfwevzWFXdsbhPcK7Wtv9OWi7XaGBEQp9z5SnXqKTPu0A9j6lZT6Wogl/yEIOmyhTP76 Zi0xPbNPc9OAip9NnShEpmER4bR05hFcbsOZeCFtiIZLDqz60j/m/tQe6tYKjUbfZZh5JTSvp kfAnKjCFZotRlTB+I/mEIcc5eCHWtdEo5LOUerik01w4+ZYfpsweF9FkfiUBOiY3CSh2m3b7a o0PZpFJHAuXBEiB2qXpaS+PGdeHg5wvmwZT1yIVFgdPFYH3HHttK5/AZmTkk5pImlwYFpyHp9 3VRiKGw84aOaggFd8GlvUi7NYGEVW5aqQwV8Tw== Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, Arnd Bergmann Subject: [alsa-devel] [PATCH v2 3/7] ALSA: ad1848: fix format string overflow warning X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP The snd_pcm name is too long to fit into the card shortname or a part of the longname: sound/isa/ad1848/ad1848.c: In function 'snd_ad1848_probe': sound/isa/ad1848/ad1848.c:116:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=] sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/isa/ad1848/ad1848.c:116:2: note: 'sprintf' output between 22 and 128 bytes into a destination of size 80 sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ chip->pcm->name, chip->port, irq[n], dma1[n]); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This changes the code to use length-checking functions that truncate if necessary. The "[Thinkpad]" substring is now also part of the snprintf(), as that could also overflow the buffer. Signed-off-by: Arnd Bergmann --- sound/isa/ad1848/ad1848.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/sound/isa/ad1848/ad1848.c b/sound/isa/ad1848/ad1848.c index e739b1c85c25..7c8e92f62f3b 100644 --- a/sound/isa/ad1848/ad1848.c +++ b/sound/isa/ad1848/ad1848.c @@ -110,13 +110,17 @@ static int snd_ad1848_probe(struct device *dev, unsigned int n) if (error < 0) goto out; - strcpy(card->driver, "AD1848"); - strcpy(card->shortname, chip->pcm->name); - - sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", - chip->pcm->name, chip->port, irq[n], dma1[n]); - if (thinkpad[n]) - strcat(card->longname, " [Thinkpad]"); + strlcpy(card->driver, "AD1848", sizeof(card->driver)); + strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname)); + + if (!thinkpad[n]) + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %d, dma %d", + chip->pcm->name, chip->port, irq[n], dma1[n]); + else + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %d, dma %d [Thinkpad]", + chip->pcm->name, chip->port, irq[n], dma1[n]); error = snd_card_register(card); if (error < 0)