snd_ac97_get_name() appends the codec name using two strlcat() calls and then appends the revision using an unbounded sprintf() at "name + strlen(name)", which could overflow the destination buffer.
In preparation for removing the deprecated strlcat() API[1], replace the strlcat() and sprintf() calls with a single snprintf() using the existing string length, matching the pattern already used in the "else" branch. Link: https://github.com/KSPP/linux/issues/370 [1] Cc: [email protected] Assisted-by: Claude-3-5-Sonnet:20241022 [editor_update_file, shell_command_run] Signed-off-by: Bill Wendling <[email protected]> --- Cc: Russell King <[email protected]> Cc: Huacai Chen <[email protected]> Cc: WANG Xuerui <[email protected]> Cc: Thomas Bogendoerfer <[email protected]> Cc: "James E.J. Bottomley" <[email protected]> Cc: Helge Deller <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: Dave Hansen <[email protected]> Cc: [email protected] Cc: "H. Peter Anvin" <[email protected]> Cc: Ian Abbott <[email protected]> Cc: H Hartley Sweeten <[email protected]> Cc: Tony Luck <[email protected]> Cc: Maarten Lankhorst <[email protected]> Cc: Maxime Ripard <[email protected]> Cc: Thomas Zimmermann <[email protected]> Cc: David Airlie <[email protected]> Cc: Simona Vetter <[email protected]> Cc: Matthew Brost <[email protected]> Cc: "Thomas Hellström" <[email protected]> Cc: Rodrigo Vivi <[email protected]> Cc: Dmitry Torokhov <[email protected]> Cc: Matthias Schwarzott <[email protected]> Cc: Mauro Carvalho Chehab <[email protected]> Cc: Tony Nguyen <[email protected]> Cc: Przemek Kitszel <[email protected]> Cc: Andrew Lunn <[email protected]> Cc: "David S. Miller" <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Jakub Kicinski <[email protected]> Cc: Paolo Abeni <[email protected]> Cc: Arend van Spriel <[email protected]> Cc: Rob Herring <[email protected]> Cc: Saravana Kannan <[email protected]> Cc: Krzysztof Kozlowski <[email protected]> Cc: Sylwester Nawrocki <[email protected]> Cc: Peter Griffin <[email protected]> Cc: Alim Akhtar <[email protected]> Cc: Linus Walleij <[email protected]> Cc: Anil Gurumurthy <[email protected]> Cc: Sudarsana Kalluru <[email protected]> Cc: "Martin K. Petersen" <[email protected]> Cc: Trond Myklebust <[email protected]> Cc: Anna Schumaker <[email protected]> Cc: Mike Marshall <[email protected]> Cc: Martin Brandenburg <[email protected]> Cc: Kees Cook <[email protected]> Cc: Jiri Pirko <[email protected]> Cc: Simon Horman <[email protected]> Cc: Chuck Lever <[email protected]> Cc: Jeff Layton <[email protected]> Cc: NeilBrown <[email protected]> Cc: Olga Kornievskaia <[email protected]> Cc: Dai Ngo <[email protected]> Cc: Tom Talpey <[email protected]> Cc: Jaroslav Kysela <[email protected]> Cc: Takashi Iwai <[email protected]> Cc: Bill Wendling <[email protected]> Cc: Andrew Morton <[email protected]> Cc: "Mike Rapoport (Microsoft)" <[email protected]> Cc: Kanglong Wang <[email protected]> Cc: Tiezhu Yang <[email protected]> Cc: Qiang Ma <[email protected]> Cc: Randy Dunlap <[email protected]> Cc: Pengpeng Hou <[email protected]> Cc: Ard Biesheuvel <[email protected]> Cc: Breno Leitao <[email protected]> Cc: Thorsten Blum <[email protected]> Cc: Harshit Mogalapalli <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Lyude Paul <[email protected]> Cc: Ashutosh Desai <[email protected]> Cc: Imre Deak <[email protected]> Cc: Dmitry Baryshkov <[email protected]> Cc: Johan Hovold <[email protected]> Cc: Johannes Berg <[email protected]> Cc: Miri Korenblit <[email protected]> Cc: Alexander Stein <[email protected]> Cc: Cryolitia PukNgae <[email protected]> Cc: Jiaming Zhang <[email protected]> Cc: Will Porter <[email protected]> Cc: Cen Zhang <[email protected]> Cc: "Cássio Gabriel" <[email protected]> Cc: Rong Zhang <[email protected]> Cc: Arun Raghavan <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] --- sound/pci/ac97/ac97_codec.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c index 0bb65be021d9..e145099ee02a 100644 --- a/sound/pci/ac97/ac97_codec.c +++ b/sound/pci/ac97/ac97_codec.c @@ -1850,10 +1850,12 @@ void snd_ac97_get_name(struct snd_ac97 *ac97, unsigned int id, char *name, pid = look_for_codec_id(snd_ac97_codec_ids, id); if (pid) { - strlcat(name, " ", maxlen); - strlcat(name, pid->name, maxlen); + int l = strlen(name); + if (pid->mask != 0xffffffff) - sprintf(name + strlen(name), " rev %u", id & ~pid->mask); + snprintf(name + l, maxlen - l, " %s rev %u", pid->name, id & ~pid->mask); + else + snprintf(name + l, maxlen - l, " %s", pid->name); if (ac97 && pid->patch) { if ((modem && (pid->flags & AC97_MODEM_PATCH)) || (! modem && ! (pid->flags & AC97_MODEM_PATCH))) @@ -1861,6 +1863,7 @@ void snd_ac97_get_name(struct snd_ac97 *ac97, unsigned int id, char *name, } } else { int l = strlen(name); + snprintf(name + l, maxlen - l, " id %x", id & 0xff); } } -- 2.55.0.1032.g73a4cd73de-goog
