Commit 6d8b04de authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Takashi Iwai
Browse files

ALSA: cs423x: fix format string overflow warning 



The snd_pcm name may overflow the card->longname total size:

sound/isa/cs423x/cs4231.c: In function 'snd_cs4231_probe':
sound/isa/cs423x/cs4231.c:115:26: error: ' at 0x' directive writing 6 bytes into a region of size between 1 and 80 [-Werror=format-overflow=] 0x%lx, irq %d, dma %d",
  sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",
                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This changes the driver to use snprintf() so we truncate the string
instead of overflowing into the next field if that happens.

I decided to split out the second format string for the extra
DMA channel to keep the code simpler.

Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 8a463639

sound/isa/cs423x/cs4231.c

+11 −7
Original line number Diff line number Diff line
@@ -109,13 +109,17 @@ static int snd_cs4231_probe(struct device *dev, unsigned int n) 
	if (error < 0)

		goto out;



	strcpy(card->driver, "CS4231");

	strcpy(card->shortname, chip->pcm->name);

	strlcpy(card->driver, "CS4231", sizeof(card->driver));

	strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname));



	sprintf(card->longname, "%s at 0x%lx, irq %d, dma %d",

	if (dma2[n] < 0)

		snprintf(card->longname, sizeof(card->longname),

			 "%s at 0x%lx, irq %d, dma %d",

			 chip->pcm->name, chip->port, irq[n], dma1[n]);

	if (dma2[n] >= 0)

		sprintf(card->longname + strlen(card->longname), "&%d", dma2[n]);

	else

		snprintf(card->longname, sizeof(card->longname),

			 "%s at 0x%lx, irq %d, dma %d&%d",

			 chip->pcm->name, chip->port, irq[n], dma1[n], dma2[n]);



	error = snd_wss_mixer(chip);

	if (error < 0)

sound/isa/cs423x/cs4236.c

+11 −9
Original line number Diff line number Diff line
@@ -419,15 +419,17 @@ static int snd_cs423x_probe(struct snd_card *card, int dev) 
		if (err < 0)

			return err;

	}

	strcpy(card->driver, chip->pcm->name);

	strcpy(card->shortname, chip->pcm->name);

	sprintf(card->longname, "%s at 0x%lx, irq %i, dma %i",

		chip->pcm->name,

		chip->port,

		irq[dev],

		dma1[dev]);

	if (dma2[dev] >= 0)

		sprintf(card->longname + strlen(card->longname), "&%d", dma2[dev]);

	strlcpy(card->driver, chip->pcm->name, sizeof(card->driver));

	strlcpy(card->shortname, chip->pcm->name, sizeof(card->shortname));

	if (dma2[dev] < 0)

		snprintf(card->longname, sizeof(card->longname),

			 "%s at 0x%lx, irq %i, dma %i",

			 chip->pcm->name, chip->port, irq[dev], dma1[dev]);

	else

		snprintf(card->longname, sizeof(card->longname),

			 "%s at 0x%lx, irq %i, dma %i&%d",

			 chip->pcm->name, chip->port, irq[dev], dma1[dev],

			 dma2[dev]);



	err = snd_wss_timer(chip, 0);

	if (err < 0)

CRA Git | Maintained and supported by SUSTech CRA and CCSE