| Message ID | 20230109150119.342771-1-perex@perex.cz (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2] ALSA: control-led: use strscpy in set_led_id() | expand |
On Mon, 09 Jan 2023 16:01:18 +0100, Jaroslav Kysela wrote: > > The use of strncpy() in the set_led_id() was incorrect. > The len variable should use 'min(sizeof(buf2) - 1, count)' > expression. > > Use strscpy() function to simplify things and handle the error gracefully. > > Reported-by: yang.yang29@zte.com.cn > BugLink: https://lore.kernel.org/alsa-devel/202301091945513559977@zte.com.cn/ Let's use the normal Link tag instead of BugLink. The former is preferred. Also, it'd be great if you can put the Fixes tag, too. thanks, Takashi
On 09. 01. 23 16:04, Takashi Iwai wrote: > On Mon, 09 Jan 2023 16:01:18 +0100, > Jaroslav Kysela wrote: >> >> The use of strncpy() in the set_led_id() was incorrect. >> The len variable should use 'min(sizeof(buf2) - 1, count)' >> expression. >> >> Use strscpy() function to simplify things and handle the error gracefully. >> >> Reported-by: yang.yang29@zte.com.cn >> BugLink: https://lore.kernel.org/alsa-devel/202301091945513559977@zte.com.cn/ > > Let's use the normal Link tag instead of BugLink. The former is > preferred. > > Also, it'd be great if you can put the Fixes tag, too. Done. Sent v3. Thanks, Jaroslav
diff --git a/sound/core/control_led.c b/sound/core/control_led.c index f975cc85772b..3cadd40100f3 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -530,12 +530,11 @@ static ssize_t set_led_id(struct snd_ctl_led_card *led_card, const char *buf, si bool attach) { char buf2[256], *s, *os; - size_t len = max(sizeof(s) - 1, count); struct snd_ctl_elem_id id; int err; - strncpy(buf2, buf, len); - buf2[len] = '\0'; + if (strscpy(buf2, buf, sizeof(buf2)) < 0) + return -E2BIG; memset(&id, 0, sizeof(id)); id.iface = SNDRV_CTL_ELEM_IFACE_MIXER; s = buf2;
The use of strncpy() in the set_led_id() was incorrect. The len variable should use 'min(sizeof(buf2) - 1, count)' expression. Use strscpy() function to simplify things and handle the error gracefully. Reported-by: yang.yang29@zte.com.cn BugLink: https://lore.kernel.org/alsa-devel/202301091945513559977@zte.com.cn/ Cc: <stable@vger.kernel.org> Signed-off-by: Jaroslav Kysela <perex@perex.cz> v1..v2: - remove min() expression which strips the last char --- sound/core/control_led.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)