| From d02260824e2cad626fb2a9d62e27006d34b6dedc Mon Sep 17 00:00:00 2001 |
| From: Takashi Iwai <tiwai@suse.de> |
| Date: Mon, 27 Apr 2015 13:00:09 +0200 |
| Subject: ALSA: emu10k1: Fix card shortname string buffer overflow |
| |
| From: Takashi Iwai <tiwai@suse.de> |
| |
| commit d02260824e2cad626fb2a9d62e27006d34b6dedc upstream. |
| |
| Some models provide too long string for the shortname that has 32bytes |
| including the terminator, and it results in a non-terminated string |
| exposed to the user-space. This isn't too critical, though, as the |
| string is stopped at the succeeding longname string. |
| |
| This patch fixes such entries by dropping "SB" prefix (it's enough to |
| fit within 32 bytes, so far). Meanwhile, it also changes strcpy() |
| with strlcpy() to make sure that this kind of problem won't happen in |
| future, too. |
| |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| sound/pci/emu10k1/emu10k1.c | 6 ++++-- |
| sound/pci/emu10k1/emu10k1_main.c | 4 ++-- |
| 2 files changed, 6 insertions(+), 4 deletions(-) |
| |
| --- a/sound/pci/emu10k1/emu10k1.c |
| +++ b/sound/pci/emu10k1/emu10k1.c |
| @@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct |
| } |
| #endif |
| |
| - strcpy(card->driver, emu->card_capabilities->driver); |
| - strcpy(card->shortname, emu->card_capabilities->name); |
| + strlcpy(card->driver, emu->card_capabilities->driver, |
| + sizeof(card->driver)); |
| + strlcpy(card->shortname, emu->card_capabilities->name, |
| + sizeof(card->shortname)); |
| snprintf(card->longname, sizeof(card->longname), |
| "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", |
| card->shortname, emu->revision, emu->serial, emu->port, emu->irq); |
| --- a/sound/pci/emu10k1/emu10k1_main.c |
| +++ b/sound/pci/emu10k1/emu10k1_main.c |
| @@ -1421,7 +1421,7 @@ static struct snd_emu_chip_details emu_c |
| * |
| */ |
| {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, |
| - .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", |
| + .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]", |
| .id = "Audigy2", |
| .emu10k2_chip = 1, |
| .ca0108_chip = 1, |
| @@ -1571,7 +1571,7 @@ static struct snd_emu_chip_details emu_c |
| .adc_1361t = 1, /* 24 bit capture instead of 16bit */ |
| .ac97_chip = 1} , |
| {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, |
| - .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", |
| + .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]", |
| .id = "Audigy2", |
| .emu10k2_chip = 1, |
| .ca0102_chip = 1, |
