Commit 003d3e70 authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Takashi Iwai

ALSA: ad1848: fix format string overflow warning

The snd_pcm name is too long to fit into the card shortname
or a part of the longname:

sound/isa/ad1848/ad1848.c: In function 'snd_ad1848_probe':
sound/isa/ad1848/ad1848.c:116:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=]
  sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
sound/isa/ad1848/ad1848.c:116:2: note: 'sprintf' output between 22 and 128 bytes into a destination of size 80
  sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   chip->pcm->name, chip->port, irq[n], dma1[n]);
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This changes the code to use length-checking functions that truncate
if necessary. The "[Thinkpad]" substring is now also part of the
snprintf(), as that could also overflow the buffer.
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 6d8b04de
...@@ -110,13 +110,17 @@ static int snd_ad1848_probe(struct device *dev, unsigned int n) ...@@ -110,13 +110,17 @@ static int snd_ad1848_probe(struct device *dev, unsigned int n)
if (error < 0) if (error < 0)
goto out; goto out;
strcpy(card->driver, "AD1848"); strlcpy(card->driver, "AD1848", sizeof(card->driver));
strcpy(card->shortname, chip->pcm->name); strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname));
sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d", if (!thinkpad[n])
chip->pcm->name, chip->port, irq[n], dma1[n]); snprintf(card->longname, sizeof(card->longname),
if (thinkpad[n]) "%s at 0x%lx, irq %d, dma %d",
strcat(card->longname, " [Thinkpad]"); chip->pcm->name, chip->port, irq[n], dma1[n]);
else
snprintf(card->longname, sizeof(card->longname),
"%s at 0x%lx, irq %d, dma %d [Thinkpad]",
chip->pcm->name, chip->port, irq[n], dma1[n]);
error = snd_card_register(card); error = snd_card_register(card);
if (error < 0) if (error < 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment