V4L/DVB (13378): konicawc.c: possible buffer overflow while use strncat

Browse source

In driver ./drivers/media/video/usbvideo/konicawc.c in line 227:

227         usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));

After this line we use strncat:

228         strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));

where sizeof(cam->input_physname) returns length of cam->input_phisname
without length for null-symbol.  But this parameter must be - "maximum
numbers of bytes to copy", i.e.:
sizeof(cam->input_physname)-strlen(cam->input_physname)-1.

In this case, after call to usb_make_path the similar drivers use strlcat.

Like in drivers/hid/usbhid/hid-core.c:
1152         usb_make_path(dev, hid->phys, sizeof(hid->phys));
1153         strlcat(hid->phys, "/input", sizeof(hid->phys));

Found by Linux Driver Verification Project.

Use strlcat instead of strncat.

Signed-off-by: Alexander Strakh <strakh@ispras.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

...

This commit is contained in:

Alexander Strakh 2009-11-17 19:43:37 -03:00 • committed by Mauro Carvalho Chehab

parent 38a54f35a0

commit caac970f91

1 changed files with 1 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/media/video/usbvideo/konicawc.c

View file