Commit e45af6c8 authored by Takashi Iwai's avatar Takashi Iwai Committed by Luis Henriques

ALSA: emu10k1: Fix card shortname string buffer overflow

commit d0226082 upstream.

Some models provide too long string for the shortname that has 32bytes
including the terminator, and it results in a non-terminated string
exposed to the user-space.  This isn't too critical, though, as the
string is stopped at the succeeding longname string.

This patch fixes such entries by dropping "SB" prefix (it's enough to
fit within 32 bytes, so far).  Meanwhile, it also changes strcpy()
with strlcpy() to make sure that this kind of problem won't happen in
future, too.
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
parent a92a43a1
...@@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci, ...@@ -183,8 +183,10 @@ static int snd_card_emu10k1_probe(struct pci_dev *pci,
} }
#endif #endif
strcpy(card->driver, emu->card_capabilities->driver); strlcpy(card->driver, emu->card_capabilities->driver,
strcpy(card->shortname, emu->card_capabilities->name); sizeof(card->driver));
strlcpy(card->shortname, emu->card_capabilities->name,
sizeof(card->shortname));
snprintf(card->longname, sizeof(card->longname), snprintf(card->longname, sizeof(card->longname),
"%s (rev.%d, serial:0x%x) at 0x%lx, irq %i", "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
card->shortname, emu->revision, emu->serial, emu->port, emu->irq); card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
......
...@@ -1424,7 +1424,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { ...@@ -1424,7 +1424,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
* *
*/ */
{.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102, {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
.driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]", .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
.id = "Audigy2", .id = "Audigy2",
.emu10k2_chip = 1, .emu10k2_chip = 1,
.ca0108_chip = 1, .ca0108_chip = 1,
...@@ -1574,7 +1574,7 @@ static struct snd_emu_chip_details emu_chip_details[] = { ...@@ -1574,7 +1574,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
.adc_1361t = 1, /* 24 bit capture instead of 16bit */ .adc_1361t = 1, /* 24 bit capture instead of 16bit */
.ac97_chip = 1} , .ac97_chip = 1} ,
{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102, {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
.driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]", .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
.id = "Audigy2", .id = "Audigy2",
.emu10k2_chip = 1, .emu10k2_chip = 1,
.ca0102_chip = 1, .ca0102_chip = 1,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment