queue-4.19/alsa-seq-fix-oob-reads-from-strlcpy.patch

   1 From 212ac181c158c09038c474ba68068be49caecebb Mon Sep 17 00:00:00 2001
   2 From: Zubin Mithra <zsm@chromium.org>
   3 Date: Thu, 4 Apr 2019 14:33:55 -0700
   4 Subject: ALSA: seq: Fix OOB-reads from strlcpy
   5
   6 From: Zubin Mithra <zsm@chromium.org>
   7
   8 commit 212ac181c158c09038c474ba68068be49caecebb upstream.
   9
  10 When ioctl calls are made with non-null-terminated userspace strings,
  11 strlcpy causes an OOB-read from within strlen. Fix by changing to use
  12 strscpy instead.
  13
  14 Signed-off-by: Zubin Mithra <zsm@chromium.org>
  15 Reviewed-by: Guenter Roeck <groeck@chromium.org>
  16 Cc: <stable@vger.kernel.org>
  17 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19
  20 ---
  21  sound/core/seq/seq_clientmgr.c |    6 +++---
  22  1 file changed, 3 insertions(+), 3 deletions(-)
  23
  24 --- a/sound/core/seq/seq_clientmgr.c
  25 +++ b/sound/core/seq/seq_clientmgr.c
  26 @@ -1252,7 +1252,7 @@ static int snd_seq_ioctl_set_client_info
  27
  28         /* fill the info fields */
  29         if (client_info->name[0])
  30 -               strlcpy(client->name, client_info->name, sizeof(client->name));
  31 +               strscpy(client->name, client_info->name, sizeof(client->name));
  32
  33         client->filter = client_info->filter;
  34         client->event_lost = client_info->event_lost;
  35 @@ -1530,7 +1530,7 @@ static int snd_seq_ioctl_create_queue(st
  36         /* set queue name */
  37         if (!info->name[0])
  38                 snprintf(info->name, sizeof(info->name), "Queue-%d", q->queue);
  39 -       strlcpy(q->name, info->name, sizeof(q->name));
  40 +       strscpy(q->name, info->name, sizeof(q->name));
  41         snd_use_lock_free(&q->use_lock);
  42
  43         return 0;
  44 @@ -1592,7 +1592,7 @@ static int snd_seq_ioctl_set_queue_info(
  45                 queuefree(q);
  46                 return -EPERM;
  47         }
  48 -       strlcpy(q->name, info->name, sizeof(q->name));
  49 +       strscpy(q->name, info->name, sizeof(q->name));
  50         queuefree(q);
  51
  52         return 0;