On Tue, Sep 15, 2026 at 08:18:18AM +0000, Bill Wendling wrote:
> --- a/sound/pci/ac97/ac97_codec.c
> +++ b/sound/pci/ac97/ac97_codec.c
> @@ -1850,10 +1850,12 @@ void snd_ac97_get_name(struct snd_ac97 *ac97,
> unsigned int id, char *name,
>
> pid = look_for_codec_id(snd_ac97_codec_ids, id);
> if (pid) {
> - strlcat(name, " ", maxlen);
> - strlcat(name, pid->name, maxlen);
> + int l = strlen(name);
> +
> if (pid->mask != 0xffffffff)
> - sprintf(name + strlen(name), " rev %u", id &
> ~pid->mask);
> + snprintf(name + l, maxlen - l, " %s rev %u", pid->name,
> id & ~pid->mask);
> + else
> + snprintf(name + l, maxlen - l, " %s", pid->name);
> if (ac97 && pid->patch) {
> if ((modem && (pid->flags & AC97_MODEM_PATCH)) ||
> (! modem && ! (pid->flags & AC97_MODEM_PATCH)))
> @@ -1861,6 +1863,7 @@ void snd_ac97_get_name(struct snd_ac97 *ac97, unsigned
> int id, char *name,
> }
> } else {
> int l = strlen(name);
> +
> snprintf(name + l, maxlen - l, " id %x", id & 0xff);
> }
> }
I'd rather not open-code the length math here. Can't we use seq_buf()
instead?
--
Kees Cook
