On Thu, Apr 4, 2019 at 2:34 PM Zubin Mithra zsm@chromium.org wrote:

When ioctl calls are made with non-null-terminated userspace strings, strlcpy causes an OOB-read from within strlen. Fix by changing to use strscpy instead.

Signed-off-by: Zubin Mithra zsm@chromium.org

Reviewed-by: Guenter Roeck groeck@chromium.org

---

sound/core/seq/seq_clientmgr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c index 7d4640d1fe9fb..38e7deab63847 100644 --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client,

    /* fill the info fields */
    if (client_info->name[0])

•           strlcpy(client->name, client_info->name, sizeof(client->name));
  

•           strscpy(client->name, client_info->name, sizeof(client->name));
  
    client->filter = client_info->filter;
    client->event_lost = client_info->event_lost;
  

@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg) /* set queue name */ if (!info->name[0]) snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);

•   strlcpy(q->name, info->name, sizeof(q->name));
  

•   strscpy(q->name, info->name, sizeof(q->name));
    snd_use_lock_free(&q->use_lock);
  
    return 0;
  

@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client, queuefree(q); return -EPERM; }

•   strlcpy(q->name, info->name, sizeof(q->name));
  

•   strscpy(q->name, info->name, sizeof(q->name));
    queuefree(q);
  
    return 0;
  

-- 2.21.0.392.gf8f6787159e-goog