On Thu, Apr 4, 2019 at 2:34 PM Zubin Mithra <zsm@xxxxxxxxxxxx> wrote: > > When ioctl calls are made with non-null-terminated userspace strings, > strlcpy causes an OOB-read from within strlen. Fix by changing to use > strscpy instead. > > Signed-off-by: Zubin Mithra <zsm@xxxxxxxxxxxx> Reviewed-by: Guenter Roeck <groeck@xxxxxxxxxxxx> > --- > sound/core/seq/seq_clientmgr.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c > index 7d4640d1fe9fb..38e7deab63847 100644 > --- a/sound/core/seq/seq_clientmgr.c > +++ b/sound/core/seq/seq_clientmgr.c > @@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client, > > /* fill the info fields */ > if (client_info->name[0]) > - strlcpy(client->name, client_info->name, sizeof(client->name)); > + strscpy(client->name, client_info->name, sizeof(client->name)); > > client->filter = client_info->filter; > client->event_lost = client_info->event_lost; > @@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg) > /* set queue name */ > if (!info->name[0]) > snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue); > - strlcpy(q->name, info->name, sizeof(q->name)); > + strscpy(q->name, info->name, sizeof(q->name)); > snd_use_lock_free(&q->use_lock); > > return 0; > @@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client, > queuefree(q); > return -EPERM; > } > - strlcpy(q->name, info->name, sizeof(q->name)); > + strscpy(q->name, info->name, sizeof(q->name)); > queuefree(q); > > return 0; > -- > 2.21.0.392.gf8f6787159e-goog > _______________________________________________ Alsa-devel mailing list Alsa-devel@xxxxxxxxxxxxxxxx https://mailman.alsa-project.org/mailman/listinfo/alsa-devel
