iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ASoC: Fix theoretical buffer overflow by snprintf()

Browse Source 
Merge series from Takashi Iwai <tiwai@suse.de>:

This is a patch series to paper over the theoretical buffer overflow
that might be caused by snprintf().  snprintf() is notorious for its
behavior and the usage of a safer version, scnprintf(), is
recommended.
This commit is contained in:
Mark Brown 2022-08-05 15:24:07 +01:00
commit 5549af7f42
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/soc/intel/avs/pcm.c
View File

@ -636,8 +636,8 @@ static ssize_t topology_name_read(struct file *file, char __user *user_buf, size
char buf[64];
size_t len;
len = snprintf(buf, sizeof(buf), "%s/%s\n", component->driver->topology_name_prefix,
mach->tplg_filename);
len = scnprintf(buf, sizeof(buf), "%s/%s\n", component->driver->topology_name_prefix,
mach->tplg_filename);
return simple_read_from_buffer(user_buf, count, ppos, buf, len);
}

6
sound/soc/sof/debug.c
View File

@ -252,9 +252,9 @@ static int memory_info_update(struct snd_sof_dev *sdev, char *buf, size_t buff_s
}
for (i = 0, len = 0; i < reply->num_elems; i++) {
ret = snprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n",
reply->elems[i].zone, reply->elems[i].id,
reply->elems[i].used, reply->elems[i].free);
ret = scnprintf(buf + len, buff_size - len, "zone %d.%d used %#8x free %#8x\n",
reply->elems[i].zone, reply->elems[i].id,
reply->elems[i].used, reply->elems[i].free);
if (ret < 0)
goto error;
len += ret;

2
sound/soc/sof/intel/hda.c
View File

@ -574,7 +574,7 @@ static void hda_dsp_dump_ext_rom_status(struct snd_sof_dev *sdev, const char *le
chip = get_chip_info(sdev->pdata);
for (i = 0; i < HDA_EXT_ROM_STATUS_SIZE; i++) {
value = snd_sof_dsp_read(sdev, HDA_DSP_BAR, chip->rom_status_reg + i * 0x4);
len += snprintf(msg + len, sizeof(msg) - len, " 0x%x", value);
len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value);
}
dev_printk(level, sdev->dev, "extended rom status: %s", msg);