aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJason Gerecke <[email protected]>2023-04-14 11:22:10 -0700
committerJiri Kosina <[email protected]>2023-05-23 15:06:36 +0200
commitd9eef346b601afb0bd74b49e0db06f6a5cebd030 (patch)
treead8e6988dc35dc91dd4e0eee4c4db0a6e1948b4a
parent34da76dca4673ab1819830b4924bb5b436325b26 (diff)
HID: wacom: Check for string overflow from strscpy calls
The strscpy function is able to return an error code when a copy would overflow the size of the destination. The copy is stopped and the buffer terminated before overflow actually occurs so it is safe to continue execution, but we should still produce a warning should this occur. Signed-off-by: Jason Gerecke <[email protected]> Reviewed-by: Ping Cheng <[email protected]> Reviewed-by: Peter Hutterer <[email protected]> Signed-off-by: Jiri Kosina <[email protected]>
-rw-r--r--drivers/hid/wacom_sys.c14
1 files changed, 10 insertions, 4 deletions
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 8214896adada..7192970d199a 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2224,7 +2224,9 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
} else if (strstr(product_name, "Wacom") ||
strstr(product_name, "wacom") ||
strstr(product_name, "WACOM")) {
- strscpy(name, product_name, sizeof(name));
+ if (strscpy(name, product_name, sizeof(name)) < 0) {
+ hid_warn(wacom->hdev, "String overflow while assembling device name");
+ }
} else {
snprintf(name, sizeof(name), "Wacom %s", product_name);
}
@@ -2242,7 +2244,9 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
if (name[strlen(name)-1] == ' ')
name[strlen(name)-1] = '\0';
} else {
- strscpy(name, features->name, sizeof(name));
+ if (strscpy(name, features->name, sizeof(name)) < 0) {
+ hid_warn(wacom->hdev, "String overflow while assembling device name");
+ }
}
snprintf(wacom_wac->name, sizeof(wacom_wac->name), "%s%s",
@@ -2500,8 +2504,10 @@ static void wacom_wireless_work(struct work_struct *work)
goto fail;
}
- strscpy(wacom_wac->name, wacom_wac1->name,
- sizeof(wacom_wac->name));
+ if (strscpy(wacom_wac->name, wacom_wac1->name,
+ sizeof(wacom_wac->name)) < 0) {
+ hid_warn(wacom->hdev, "String overflow while assembling device name");
+ }
}
return;