Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-28 13:51:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

HID: wacom: Check for string overflow from strscpy calls

Browse Source 
The strscpy function is able to return an error code when a copy would
overflow the size of the destination. The copy is stopped and the buffer
terminated before overflow actually occurs so it is safe to continue
execution, but we should still produce a warning should this occur.

Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
This commit is contained in:
Jason Gerecke 2023-04-14 11:22:10 -07:00 committed by Jiri Kosina
parent 34da76dca4
commit d9eef346b6
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/hid/wacom_sys.c
View File

@ -2224,7 +2224,9 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
} else if (strstr(product_name, "Wacom") ||
strstr(product_name, "wacom") ||
strstr(product_name, "WACOM")) {
strscpy(name, product_name, sizeof(name));
if (strscpy(name, product_name, sizeof(name)) < 0) {
hid_warn(wacom->hdev, "String overflow while assembling device name");
}
} else {
snprintf(name, sizeof(name), "Wacom %s", product_name);
}
@ -2242,7 +2244,9 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
if (name[strlen(name)-1] == ' ')
name[strlen(name)-1] = '\0';
} else {
strscpy(name, features->name, sizeof(name));
if (strscpy(name, features->name, sizeof(name)) < 0) {
hid_warn(wacom->hdev, "String overflow while assembling device name");
}
}
snprintf(wacom_wac->name, sizeof(wacom_wac->name), "%s%s",
@ -2500,8 +2504,10 @@ static void wacom_wireless_work(struct work_struct *work)
goto fail;
}
strscpy(wacom_wac->name, wacom_wac1->name,
sizeof(wacom_wac->name));
if (strscpy(wacom_wac->name, wacom_wac1->name,
sizeof(wacom_wac->name)) < 0) {
hid_warn(wacom->hdev, "String overflow while assembling device name");
}
}
return;