Commit d278a9de authored by Jaroslav Kysela's avatar Jaroslav Kysela Committed by Takashi Iwai

ALSA: core: add isascii() check to card ID generator

The card identifier should contain only safe ASCII characters. The isalnum()
returns true also for characters for non-ASCII characters.

Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4135
Link: https://lore.kernel.org/linux-sound/yk3WTvKkwheOon_LzZlJ43PPInz6byYfBzpKkbasww1yzuiMRqn7n6Y8vZcXB-xwFCu_vb8hoNjv7DTNwH5TWjpEuiVsyn9HPCEXqwF4120=@protonmail.com/
Cc: stable@vger.kernel.org
Reported-by: default avatarBarnabás Pőcze <pobrn@protonmail.com>
Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
Link: https://patch.msgid.link/20241002194649.1944696-1-perex@perex.czSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 33027006
...@@ -654,13 +654,19 @@ void snd_card_free(struct snd_card *card) ...@@ -654,13 +654,19 @@ void snd_card_free(struct snd_card *card)
} }
EXPORT_SYMBOL(snd_card_free); EXPORT_SYMBOL(snd_card_free);
/* check, if the character is in the valid ASCII range */
static inline bool safe_ascii_char(char c)
{
return isascii(c) && isalnum(c);
}
/* retrieve the last word of shortname or longname */ /* retrieve the last word of shortname or longname */
static const char *retrieve_id_from_card_name(const char *name) static const char *retrieve_id_from_card_name(const char *name)
{ {
const char *spos = name; const char *spos = name;
while (*name) { while (*name) {
if (isspace(*name) && isalnum(name[1])) if (isspace(*name) && safe_ascii_char(name[1]))
spos = name + 1; spos = name + 1;
name++; name++;
} }
...@@ -687,12 +693,12 @@ static void copy_valid_id_string(struct snd_card *card, const char *src, ...@@ -687,12 +693,12 @@ static void copy_valid_id_string(struct snd_card *card, const char *src,
{ {
char *id = card->id; char *id = card->id;
while (*nid && !isalnum(*nid)) while (*nid && !safe_ascii_char(*nid))
nid++; nid++;
if (isdigit(*nid)) if (isdigit(*nid))
*id++ = isalpha(*src) ? *src : 'D'; *id++ = isalpha(*src) ? *src : 'D';
while (*nid && (size_t)(id - card->id) < sizeof(card->id) - 1) { while (*nid && (size_t)(id - card->id) < sizeof(card->id) - 1) {
if (isalnum(*nid)) if (safe_ascii_char(*nid))
*id++ = *nid; *id++ = *nid;
nid++; nid++;
} }
...@@ -787,7 +793,7 @@ static ssize_t id_store(struct device *dev, struct device_attribute *attr, ...@@ -787,7 +793,7 @@ static ssize_t id_store(struct device *dev, struct device_attribute *attr,
for (idx = 0; idx < copy; idx++) { for (idx = 0; idx < copy; idx++) {
c = buf[idx]; c = buf[idx];
if (!isalnum(c) && c != '_' && c != '-') if (!safe_ascii_char(c) && c != '_' && c != '-')
return -EINVAL; return -EINVAL;
} }
memcpy(buf1, buf, copy); memcpy(buf1, buf, copy);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment