diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2017-07-18 13:48:05 +0200 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2017-07-18 17:51:55 +0200 |
| commit | 6d8b04de87e1d736dad0ce7079e0ea112ab160c3 (patch) | |
| tree | 86154aaecf552c8888aea1f17d9c12c586a680ba /sound/isa/cs423x/cs4231.c | |
| parent | 8a463639db5781ed52c972db013eba7d834f440d (diff) | |
ALSA: cs423x: fix format string overflow warning
The snd_pcm name may overflow the card->longname total size:
sound/isa/cs423x/cs4231.c: In function 'snd_cs4231_probe':
sound/isa/cs423x/cs4231.c:115:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=] 0x%lx, irq %d, dma %d",
sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This changes the driver to use snprintf() so we truncate the string
instead of overflowing into the next field if that happens.
I decided to split out the second format string for the extra
DMA channel to keep the code simpler.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/isa/cs423x/cs4231.c')
| -rw-r--r-- | sound/isa/cs423x/cs4231.c | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/sound/isa/cs423x/cs4231.c b/sound/isa/cs423x/cs4231.c index e8edd9017a2f..d90ab9558f7f 100644 --- a/sound/isa/cs423x/cs4231.c +++ b/sound/isa/cs423x/cs4231.c @@ -109,13 +109,17 @@ static int snd_cs4231_probe(struct device *dev, unsigned int n) if (error < 0) goto out; - strcpy(card->driver, "CS4231"); - strcpy(card->shortname, chip->pcm->name); - - sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", - chip->pcm->name, chip->port, irq[n], dma1[n]); - if (dma2[n] >= 0) - sprintf(card->longname + strlen(card->longname), "&%d", dma2[n]); + strlcpy(card->driver, "CS4231", sizeof(card->driver)); + strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname)); + + if (dma2[n] < 0) + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %d, dma %d", + chip->pcm->name, chip->port, irq[n], dma1[n]); + else + snprintf(card->longname, sizeof(card->longname), + "%s at 0x%lx, irq %d, dma %d&%d", + chip->pcm->name, chip->port, irq[n], dma1[n], dma2[n]); error = snd_wss_mixer(chip); if (error < 0) |