浏览代码

sound: oss: use strlcpy() in sound_timer_init()

sound_timer.info.name is a 32 character buffer.  This function only
has one caller (in sound/oss/ad1848.c) and it passes as 128 character
buffer as "name".  I don't know if this is a problem in real life,
and I doubt we're going to add more OSS drivers so it's unlikely to
become an issue.  But we may as well take care of it.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Dan Carpenter 13 年之前
父节点
当前提交
bb690c9e27
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      sound/oss/sound_timer.c

+ 1 - 1
sound/oss/sound_timer.c

@@ -320,7 +320,7 @@ void  sound_timer_init(struct sound_lowlev_timer *t, char *name)
 	n = sound_alloc_timerdev();
 	if (n == -1)
 		n = 0;		/* Overwrite the system timer */
-	strcpy(sound_timer.info.name, name);
+	strlcpy(sound_timer.info.name, name, sizeof(sound_timer.info.name));
 	sound_timer_devs[n] = &sound_timer;
 }
 EXPORT_SYMBOL(sound_timer_init);