Skip to content

Commit

Permalink
HID: wacom: Check for string overflow from strscpy calls
Browse files Browse the repository at this point in the history
The strscpy function is able to return an error code when a copy would
overflow the size of the destination. The copy is stopped and the buffer
terminated before overflow actually occurs so it is safe to continue
execution, but we should still produce a warning should this occur.

Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
  • Loading branch information
Jason Gerecke authored and Jiri Kosina committed May 23, 2023
1 parent 34da76d commit d9eef34
Showing 1 changed file with 10 additions and 4 deletions.
14 changes: 10 additions & 4 deletions drivers/hid/wacom_sys.c
Original file line number Diff line number Diff line change
Expand Up @@ -2224,7 +2224,9 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
} else if (strstr(product_name, "Wacom") ||
strstr(product_name, "wacom") ||
strstr(product_name, "WACOM")) {
strscpy(name, product_name, sizeof(name));
if (strscpy(name, product_name, sizeof(name)) < 0) {
hid_warn(wacom->hdev, "String overflow while assembling device name");
}
} else {
snprintf(name, sizeof(name), "Wacom %s", product_name);
}
Expand All @@ -2242,7 +2244,9 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
if (name[strlen(name)-1] == ' ')
name[strlen(name)-1] = '\0';
} else {
strscpy(name, features->name, sizeof(name));
if (strscpy(name, features->name, sizeof(name)) < 0) {
hid_warn(wacom->hdev, "String overflow while assembling device name");
}
}

snprintf(wacom_wac->name, sizeof(wacom_wac->name), "%s%s",
Expand Down Expand Up @@ -2500,8 +2504,10 @@ static void wacom_wireless_work(struct work_struct *work)
goto fail;
}

strscpy(wacom_wac->name, wacom_wac1->name,
sizeof(wacom_wac->name));
if (strscpy(wacom_wac->name, wacom_wac1->name,
sizeof(wacom_wac->name)) < 0) {
hid_warn(wacom->hdev, "String overflow while assembling device name");
}
}

return;
Expand Down

0 comments on commit d9eef34

Please sign in to comment.