When no proper id string is given, the driver tries to fall back to copy the proc_root name string via strcpy(), but this might overflow the fixed string size. Let's use strlcpy().
Spotted by coverity CID 139008.
Signed-off-by: Takashi Iwai tiwai@suse.de --- sound/core/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/init.c b/sound/core/init.c index 01a89383a062..1351f22f651c 100644 --- a/sound/core/init.c +++ b/sound/core/init.c @@ -597,7 +597,7 @@ static void snd_card_set_id_no_lock(struct snd_card *card, const char *src, /* last resort... */ snd_printk(KERN_ERR "unable to set card id (%s)\n", id); if (card->proc_root->name) - strcpy(card->id, card->proc_root->name); + strlcpy(card->id, card->proc_root->name, sizeof(card->id)); }
/**