[alsa-devel] [PATCH 03/10] ALSA: Limit the fallback card id string size

Takashi Iwai tiwai at suse.de
Tue Oct 29 17:00:26 CET 2013

When no proper id string is given, the driver tries to fall back to
copy the proc_root name string via strcpy(), but this might overflow
the fixed string size.  Let's use strlcpy().

Spotted by coverity CID 139008.

Signed-off-by: Takashi Iwai <tiwai at suse.de>
 sound/core/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/init.c b/sound/core/init.c
index 01a89383a062..1351f22f651c 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -597,7 +597,7 @@ static void snd_card_set_id_no_lock(struct snd_card *card, const char *src,
 	/* last resort... */
 	snd_printk(KERN_ERR "unable to set card id (%s)\n", id);
 	if (card->proc_root->name)
-		strcpy(card->id, card->proc_root->name);
+		strlcpy(card->id, card->proc_root->name, sizeof(card->id));

More information about the Alsa-devel mailing list