github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: usb-audio: qcom: Use snprintf for mixer control name formatting

Browse Source 
The current code uses sprintf() to format control names without bounds
checking, which could lead to buffer overflow if PCM index is large.
Replace sprintf with snprintf to ensure buffer safety.

The ctl_name buffer is 48 bytes, and the formatted string could exceed
this with large PCM index values. Using snprintf with sizeof(ctl_name)
prevents potential buffer overflow.

Signed-off-by: wangdicheng <wangdicheng@kylinos.cn>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260603091102.231370-2-wangdich9700@163.com
This commit is contained in:
wangdicheng 2026-06-03 17:11:00 +08:00 committed by Takashi Iwai
parent addf228633
commit 537153aaaf
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sound/usb/qcom/mixer_usb_offload.c
View File

@ -128,7 +128,7 @@ int snd_usb_offload_create_ctl(struct snd_usb_audio *chip, struct device *bedev)
*/
chip_kctl->private_value = as->pcm_index |
chip->card->number << 16;
sprintf(ctl_name, "USB Offload Playback Card Route PCM#%d",
snprintf(ctl_name, sizeof(ctl_name), "USB Offload Playback Card Route PCM#%d",
as->pcm_index);
chip_kctl->name = ctl_name;
ret = snd_ctl_add(chip->card, snd_ctl_new1(chip_kctl, bedev));
@ -143,7 +143,7 @@ int snd_usb_offload_create_ctl(struct snd_usb_audio *chip, struct device *bedev)
*/
chip_kctl->private_value = as->pcm_index |
chip->card->number << 16;
sprintf(ctl_name, "USB Offload Playback PCM Route PCM#%d",
snprintf(ctl_name, sizeof(ctl_name), "USB Offload Playback PCM Route PCM#%d",
as->pcm_index);
chip_kctl->name = ctl_name;
ret = snd_ctl_add(chip->card, snd_ctl_new1(chip_kctl, bedev));