Hi Brian,
On Mon, Apr 20, 2020 at 9:44 AM Gix, Brian <brian.gix@xxxxxxxxx> wrote:
>
> On Mon, 2020-04-20 at 14:07 +0200, Szymon Janc wrote:
> > This one is a false positive but since we never use more than
> > UINPUT_MAX_NAME_SIZE bytes of name we can silence GCC by reducing
> > size of source string.
> >
> > CC profiles/audio/bluetoothd-avctp.o
> > In function ‘uinput_create’,
> > inlined from ‘init_uinput’ at profiles/audio/avctp.c:1259:20:
> > profiles/audio/avctp.c:1188:3: error: ‘strncpy’ output may be truncated copying 79 bytes from a string of
> > length 248 [-Werror=stringop-truncation]
> > 1188 | strncpy(dev.name, name, UINPUT_MAX_NAME_SIZE);
> > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > cc1: all warnings being treated as errors
> > ---
> > profiles/audio/avctp.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/profiles/audio/avctp.c b/profiles/audio/avctp.c
> > index 37ffde9e7..058b44a8b 100644
> > --- a/profiles/audio/avctp.c
> > +++ b/profiles/audio/avctp.c
> > @@ -1246,7 +1246,7 @@ static int uinput_create(struct btd_device *device, const char *name,
> >
> > static void init_uinput(struct avctp *session)
> > {
> > - char name[248 + 1];
> > + char name[UINPUT_MAX_NAME_SIZE];
>
> Should this be nul terminated? (UINPUT_MAX_NAME_SIZE + 1) ?
I guess not since that is send over to the kernel which accepts up to
UINPUT_MAX_NAME_SIZE so if the name is exactly 248 then the kernel
should be the one adding the NULL termination, if it doesn't then we
need to truncate by doing name[247] = '\0'.
> >
> > device_get_name(session->device, name, sizeof(name));
> > if (g_str_equal(name, "Nokia CK-20W")) {
--
Luiz Augusto von Dentz
