From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751737AbdGRLut (ORCPT ); Tue, 18 Jul 2017 07:50:49 -0400 Received: from mout.kundenserver.de ([212.227.126.130]:61396 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751399AbdGRLus (ORCPT ); Tue, 18 Jul 2017 07:50:48 -0400 From: Arnd Bergmann To: Jaroslav Kysela , Takashi Iwai , Arnd Bergmann Cc: alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 4/7] ALSA: opti9xx: fix format string overflow warning Date: Tue, 18 Jul 2017 13:48:07 +0200 Message-Id: <20170718114820.3681255-4-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20170718114820.3681255-1-arnd@arndb.de> References: <20170718114820.3681255-1-arnd@arndb.de> X-Provags-ID: V03:K0:XU1UwIz9m7DWf40g5+hdOzp+VrDQrkg5UL1dBG7DL+YYVvKdRxe ZJJqdiV2oqwClkUdyVOZ5fTxrVPn47uRBJgJpQLDyT6XMdwsdKCs5KbIFrhlQjUU4WquXle 7ylcCbWl+Biynf5WkZYJReqxKuXA9L4UmHGto/HCB2rWbp4GWuoLvbq6nL64KY3SwXuIIpz WDe2pLJBxRLfo7g8fi/lA== X-UI-Out-Filterresults: notjunk:1;V01:K0:P5JoDUM3VOA=:1Tf1RkMrPlrxyvqIhcatNv XnfCD1VhquQAh/UG+8uKBpx+fYKnDXqimnWrr5HdWZ1R3JdSY0IcI+GIft+EpalstBuL1do5e 3x5/LnRggoesE/ajcDNP1LxbZDh2et9HWLIvj3/oTPYLsAO1ax9rIItWewVXR9TM8ii8BagYF shljqEJ/8kaFMav9mSI5tqLehJxxSjpfgJ9LkVbq7dEdiwq3AP5mY0SyqJFSfayx+RAzUloXs 1gYYDqUuysRoddba9WqgHAMLQJvEQQ6OErkgkRUX0EDvDMTg0+vdx14caksVvmM6ZtC4ZkmqT 6drH1WbI8oCwudwa3WJGVSglf73uiqbn/m2Z4h0f9GaNdDMBOUuG9nGjTgo91ZrQtWvsKZV+4 Z43wcXaGjUAPedVJ+zNefl+PZ07gn6Slh3gtfD/hIVTExlA+erJ1RlR6/ggzIdB21eYTLzNM0 7/+D3tWqiZvhtsDI0cXZ+P1N+rUe9G7vE+R47oWLm+RtP7mNzbC6ARzMrDkTwscZPvyMWC6BL 3iWH/RaxMVKXbrUinni3co1hfUDJ3a7Am61+0Y6kSG13O0aqp3QZtgb4OZG5erBSL/HGGV+BA KPMbNa5lsbx2nO9pFO1KpSBZpfYyiIFwhlxnOpymBF78GBMD0ufEHcrtbkn1jU1ZUT6f9zUGB oRNLVxClghMv1VH/06LH4VtM3r1JFZKZNhRwhsPFEzNUtp9glzdV/ZmCMHL2J0i5VBUZTlq7K O3RjCRm+9q270FOT3Gnj4HxO1CaF/8hYsGP5jg== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We pass a long name from "codec->pcm->name" into the longname string of the same length: sound/isa/opti9xx/miro.c: In function 'snd_miro_probe': sound/isa/opti9xx/miro.c:1356:39: error: '%s' directive writing up to 79 bytes into a region of size between 35 and 72 [-Werror=format-overflow=] sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d", ^~ sound/isa/opti9xx/miro.c:1356:26: note: using the range [0, 4294967295] for directive argument sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/isa/opti9xx/miro.c:1356:2: note: 'sprintf' output between 32 and 185 bytes into a destination of size 80 sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d", There is no easy way to avoid the theoretical overflow in this case, but using snprintf() will turn it into a harmless truncation. Signed-off-by: Arnd Bergmann --- sound/isa/opti9xx/miro.c | 7 ++++--- sound/isa/opti9xx/opti92x-ad1848.c | 14 ++++++++------ 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c index bcbff56f060d..1c5a12fa8be3 100644 --- a/sound/isa/opti9xx/miro.c +++ b/sound/isa/opti9xx/miro.c @@ -1353,9 +1353,10 @@ static int snd_miro_probe(struct snd_card *card) } strcpy(card->driver, "miro"); - sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d", - card->shortname, miro->name, codec->pcm->name, - miro->wss_base + 4, miro->irq, miro->dma1, miro->dma2); + snprintf(card->longname, sizeof(card->longname), + "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d", + card->shortname, miro->name, codec->pcm->name, + miro->wss_base + 4, miro->irq, miro->dma1, miro->dma2); if (mpu_port <= 0 || mpu_port == SNDRV_AUTO_PORT) rmidi = NULL; diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c index ceddb392b1e3..56dc581c57d5 100644 --- a/sound/isa/opti9xx/opti92x-ad1848.c +++ b/sound/isa/opti9xx/opti92x-ad1848.c @@ -879,13 +879,15 @@ static int snd_opti9xx_probe(struct snd_card *card) strcpy(card->driver, chip->name); sprintf(card->shortname, "OPTi %s", card->driver); #if defined(CS4231) || defined(OPTi93X) - sprintf(card->longname, "%s, %s at 0x%lx, irq %d, dma %d&%d", - card->shortname, codec->pcm->name, - chip->wss_base + 4, irq, dma1, xdma2); + snprintf(card->longname, sizeof(card->longname), + "%s, %s at 0x%lx, irq %d, dma %d&%d", + card->shortname, codec->pcm->name, + chip->wss_base + 4, irq, dma1, xdma2); #else - sprintf(card->longname, "%s, %s at 0x%lx, irq %d, dma %d", - card->shortname, codec->pcm->name, chip->wss_base + 4, irq, - dma1); + snprintf(card->longname, sizeof(card->longname), + "%s, %s at 0x%lx, irq %d, dma %d", + card->shortname, codec->pcm->name, chip->wss_base + 4, irq, + dma1); #endif /* CS4231 || OPTi93X */ if (mpu_port <= 0 || mpu_port == SNDRV_AUTO_PORT) -- 2.9.0