[alsa-devel] [PATCH] ALSA: seq: Fix OOB-reads from strlcpy
Guenter Roeck
groeck at google.com
Thu Apr 4 23:52:51 CEST 2019
On Thu, Apr 4, 2019 at 2:34 PM Zubin Mithra <zsm at chromium.org> wrote:
>
> When ioctl calls are made with non-null-terminated userspace strings,
> strlcpy causes an OOB-read from within strlen. Fix by changing to use
> strscpy instead.
>
> Signed-off-by: Zubin Mithra <zsm at chromium.org>
Reviewed-by: Guenter Roeck <groeck at chromium.org>
> ---
> sound/core/seq/seq_clientmgr.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
> index 7d4640d1fe9fb..38e7deab63847 100644
> --- a/sound/core/seq/seq_clientmgr.c
> +++ b/sound/core/seq/seq_clientmgr.c
> @@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client,
>
> /* fill the info fields */
> if (client_info->name[0])
> - strlcpy(client->name, client_info->name, sizeof(client->name));
> + strscpy(client->name, client_info->name, sizeof(client->name));
>
> client->filter = client_info->filter;
> client->event_lost = client_info->event_lost;
> @@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
> /* set queue name */
> if (!info->name[0])
> snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
> - strlcpy(q->name, info->name, sizeof(q->name));
> + strscpy(q->name, info->name, sizeof(q->name));
> snd_use_lock_free(&q->use_lock);
>
> return 0;
> @@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client,
> queuefree(q);
> return -EPERM;
> }
> - strlcpy(q->name, info->name, sizeof(q->name));
> + strscpy(q->name, info->name, sizeof(q->name));
> queuefree(q);
>
> return 0;
> --
> 2.21.0.392.gf8f6787159e-goog
>
More information about the Alsa-devel
mailing list