Skip to content

Commit

Permalink
ACPI: battery: Fix missing NUL-termination with large strings
Browse files Browse the repository at this point in the history
When encountering a string bigger than the destination buffer (32 bytes),
the string is not properly NUL-terminated, causing buffer overreads later.

This for example happens on the Inspiron 3505, where the battery
model name is larger than 32 bytes, which leads to sysfs showing
the model name together with the serial number string (which is
NUL-terminated and thus prevents worse).

Fix this by using strscpy() which ensures that the result is
always NUL-terminated.

Fixes: 106449e ("ACPI: Battery: Allow extract string from integer")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
  • Loading branch information
Armin Wolf authored and Rafael J. Wysocki committed Jan 18, 2023
1 parent 5dc4c99 commit f2ac14b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/acpi/battery.c
Original file line number Diff line number Diff line change
Expand Up @@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery,

if (element->type == ACPI_TYPE_STRING ||
element->type == ACPI_TYPE_BUFFER)
strncpy(ptr, element->string.pointer, 32);
strscpy(ptr, element->string.pointer, 32);
else if (element->type == ACPI_TYPE_INTEGER) {
strncpy(ptr, (u8 *)&element->integer.value,
sizeof(u64));
Expand Down

0 comments on commit f2ac14b

Please sign in to comment.