Skip to content

Commit

Permalink
ALSA: emu10k1: Fix card shortname string buffer overflow
Browse files Browse the repository at this point in the history
Some models provide too long string for the shortname that has 32bytes
including the terminator, and it results in a non-terminated string
exposed to the user-space.  This isn't too critical, though, as the
string is stopped at the succeeding longname string.

This patch fixes such entries by dropping "SB" prefix (it's enough to
fit within 32 bytes, so far).  Meanwhile, it also changes strcpy()
with strlcpy() to make sure that this kind of problem won't happen in
future, too.

Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
  • Loading branch information
Takashi Iwai committed Apr 27, 2015
1 parent 7290006 commit d022608
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 4 deletions.
6 changes: 4 additions & 2 deletions sound/pci/emu10k1/emu10k1.c
Original file line number Diff line number Diff line change
Expand Up @@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci,
}
#endif

strcpy(card->driver, emu->card_capabilities->driver);
strcpy(card->shortname, emu->card_capabilities->name);
strlcpy(card->driver, emu->card_capabilities->driver,
sizeof(card->driver));
strlcpy(card->shortname, emu->card_capabilities->name,
sizeof(card->shortname));
snprintf(card->longname, sizeof(card->longname),
"%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
Expand Down
4 changes: 2 additions & 2 deletions sound/pci/emu10k1/emu10k1_main.c
Original file line number Diff line number Diff line change
Expand Up @@ -1446,7 +1446,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
*
*/
{.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
.driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
.driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
.id = "Audigy2",
.emu10k2_chip = 1,
.ca0108_chip = 1,
Expand Down Expand Up @@ -1596,7 +1596,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
.adc_1361t = 1, /* 24 bit capture instead of 16bit */
.ac97_chip = 1} ,
{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
.driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
.driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
.id = "Audigy2",
.emu10k2_chip = 1,
.ca0102_chip = 1,
Expand Down

0 comments on commit d022608

Please sign in to comment.