Commit 73b50a56 authored by Zubin Mithra's avatar Zubin Mithra Committed by Greg Kroah-Hartman

ALSA: seq: Fix OOB-reads from strlcpy

commit 212ac181 upstream.

When ioctl calls are made with non-null-terminated userspace strings,
strlcpy causes an OOB-read from within strlen. Fix by changing to use
strscpy instead.
Signed-off-by: default avatarZubin Mithra <zsm@chromium.org>
Reviewed-by: default avatarGuenter Roeck <groeck@chromium.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d4b4aeea
...@@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client, ...@@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info(struct snd_seq_client *client,
/* fill the info fields */ /* fill the info fields */
if (client_info->name[0]) if (client_info->name[0])
strlcpy(client->name, client_info->name, sizeof(client->name)); strscpy(client->name, client_info->name, sizeof(client->name));
client->filter = client_info->filter; client->filter = client_info->filter;
client->event_lost = client_info->event_lost; client->event_lost = client_info->event_lost;
...@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg) ...@@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, void *arg)
/* set queue name */ /* set queue name */
if (!info->name[0]) if (!info->name[0])
snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue); snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
strlcpy(q->name, info->name, sizeof(q->name)); strscpy(q->name, info->name, sizeof(q->name));
snd_use_lock_free(&q->use_lock); snd_use_lock_free(&q->use_lock);
return 0; return 0;
...@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client, ...@@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(struct snd_seq_client *client,
queuefree(q); queuefree(q);
return -EPERM; return -EPERM;
} }
strlcpy(q->name, info->name, sizeof(q->name)); strscpy(q->name, info->name, sizeof(q->name));
queuefree(q); queuefree(q);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment