Skip to content

Commit

Permalink
V4L/DVB (10293): uvcvideo: replace strn{cpy,cat} with strl{cpy,cat}.
Browse files Browse the repository at this point in the history 
strncpy is unsafe as it doesn't append a terminating NUL character when the
source string doesn't fit in the destination buffer. Replace it with strlcpy.
strncat is misused as its size argument refers to the source string, not the
destination buffer. Replace it with strlcat.

Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  • Loading branch information
Laurent Pinchart authored and Mauro Carvalho Chehab committed Mar 30, 2009
1 parent 07f7db4 commit d0ebf30
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 15 deletions.
2 changes: 1 addition & 1 deletion drivers/media/video/uvc/uvc_ctrl.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -786,7 +786,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video_device *video,
memset(v4l2_ctrl, 0, sizeof *v4l2_ctrl);
v4l2_ctrl->id = mapping->id;
v4l2_ctrl->type = mapping->v4l2_type;
strncpy(v4l2_ctrl->name, mapping->name, sizeof v4l2_ctrl->name);
strlcpy(v4l2_ctrl->name, mapping->name, sizeof v4l2_ctrl->name);
v4l2_ctrl->flags = 0;

if (!(ctrl->info->flags & UVC_CONTROL_SET_CUR))
Expand Down
16 changes: 8 additions & 8 deletions drivers/media/video/uvc/uvc_driver.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -314,7 +314,7 @@ static int uvc_parse_format(struct uvc_device *dev,
fmtdesc = uvc_format_by_guid(&buffer[5]);

if (fmtdesc != NULL) {
strncpy(format->name, fmtdesc->name,
strlcpy(format->name, fmtdesc->name,
sizeof format->name);
format->fcc = fmtdesc->fcc;
} else {
Expand Down Expand Up @@ -345,7 +345,7 @@ static int uvc_parse_format(struct uvc_device *dev,
return -EINVAL;
}

strncpy(format->name, "MJPEG", sizeof format->name);
strlcpy(format->name, "MJPEG", sizeof format->name);
format->fcc = V4L2_PIX_FMT_MJPEG;
format->flags = UVC_FMT_FLAG_COMPRESSED;
format->bpp = 0;
Expand All @@ -363,13 +363,13 @@ static int uvc_parse_format(struct uvc_device *dev,

switch (buffer[8] & 0x7f) {
case 0:
strncpy(format->name, "SD-DV", sizeof format->name);
strlcpy(format->name, "SD-DV", sizeof format->name);
break;
case 1:
strncpy(format->name, "SDL-DV", sizeof format->name);
strlcpy(format->name, "SDL-DV", sizeof format->name);
break;
case 2:
strncpy(format->name, "HD-DV", sizeof format->name);
strlcpy(format->name, "HD-DV", sizeof format->name);
break;
default:
uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
Expand All @@ -379,7 +379,7 @@ static int uvc_parse_format(struct uvc_device *dev,
return -EINVAL;
}

strncat(format->name, buffer[8] & (1 << 7) ? " 60Hz" : " 50Hz",
strlcat(format->name, buffer[8] & (1 << 7) ? " 60Hz" : " 50Hz",
sizeof format->name);

format->fcc = V4L2_PIX_FMT_DV;
Expand Down Expand Up @@ -1526,7 +1526,7 @@ static int uvc_register_video(struct uvc_device *dev)
vdev->minor = -1;
vdev->fops = &uvc_fops;
vdev->release = video_device_release;
strncpy(vdev->name, dev->name, sizeof vdev->name);
strlcpy(vdev->name, dev->name, sizeof vdev->name);

/* Set the driver data before calling video_register_device, otherwise
* uvc_v4l2_open might race us.
Expand Down Expand Up @@ -1621,7 +1621,7 @@ static int uvc_probe(struct usb_interface *intf,
dev->quirks = id->driver_info | uvc_quirks_param;

if (udev->product != NULL)
strncpy(dev->name, udev->product, sizeof dev->name);
strlcpy(dev->name, udev->product, sizeof dev->name);
else
snprintf(dev->name, sizeof dev->name,
"UVC Camera (%04x:%04x)",
Expand Down
12 changes: 6 additions & 6 deletions drivers/media/video/uvc/uvc_v4l2.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ static int uvc_v4l2_query_menu(struct uvc_video_device *video,
return -EINVAL;

menu_info = &mapping->menu_info[query_menu->index];
strncpy(query_menu->name, menu_info->name, 32);
strlcpy(query_menu->name, menu_info->name, sizeof query_menu->name);
return 0;
}

Expand Down Expand Up @@ -486,9 +486,9 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
struct v4l2_capability *cap = arg;

memset(cap, 0, sizeof *cap);
strncpy(cap->driver, "uvcvideo", sizeof cap->driver);
strncpy(cap->card, vdev->name, 32);
strncpy(cap->bus_info, video->dev->udev->bus->bus_name,
strlcpy(cap->driver, "uvcvideo", sizeof cap->driver);
strlcpy(cap->card, vdev->name, sizeof cap->card);
strlcpy(cap->bus_info, video->dev->udev->bus->bus_name,
sizeof cap->bus_info);
cap->version = DRIVER_VERSION_NUMBER;
if (video->streaming->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
Expand Down Expand Up @@ -620,7 +620,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)

memset(input, 0, sizeof *input);
input->index = index;
strncpy(input->name, iterm->name, sizeof input->name);
strlcpy(input->name, iterm->name, sizeof input->name);
if (UVC_ENTITY_TYPE(iterm) == ITT_CAMERA)
input->type = V4L2_INPUT_TYPE_CAMERA;
break;
Expand Down Expand Up @@ -682,7 +682,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
fmt->flags = 0;
if (format->flags & UVC_FMT_FLAG_COMPRESSED)
fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
strncpy(fmt->description, format->name,
strlcpy(fmt->description, format->name,
sizeof fmt->description);
fmt->description[sizeof fmt->description - 1] = 0;
fmt->pixelformat = format->fcc;
Expand Down

0 comments on commit d0ebf30

Please sign in to comment.