From nobody Sat May 10 05:49:34 2025 Delivered-To: importer2@patchew.org Received-SPF: pass (zohomail.com: domain of vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; envelope-from=linux-kernel-owner@vger.kernel.org; helo=vger.kernel.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass(p=none dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1624276618; cv=none; d=zohomail.com; s=zohoarc; b=SgSrt9T5PlnMmhvW6swuLI4CUMXb+j6LBaDAZIVPR6wFB3O6tbG22yNzUkj0rlPHG+wNZUEJBIoxA7cABRtQL4kG6iOdOSi/3FwTU9s3OY/HnBE2hIiW/socCgLSG/nGVJQyjMlGWIZ3ffnA8V2WlpI6Zz3apVEBFEF9jn+UGEM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1624276618; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Id:MIME-Version:Message-ID:References:Sender:Subject:To; bh=FX1Dt750wHbHCzPAgOHhhMjQakd0A5C8OVKvAKaS6XQ=; b=FWDTyDW1rMh3C9ebrxZQRy/BzVhultPWnMaYHuqqpy/yRlKRPmh28Ne1wsyyIf3kjCzZVcUQvPs5fjBsf/5nsvyHqYde3ZP6AONxwQsLXwCb7Spe5TJnCCFYy6ccw4NnLIISAAd8X+FwBcm0CpqIWqv3ypoNizoOUtP4kuxKk88= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mx.zohomail.com with SMTP id 1624276618617951.1536645669191; Mon, 21 Jun 2021 04:56:58 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230021AbhFUL7I (ORCPT ); Mon, 21 Jun 2021 07:59:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:34232 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229640AbhFUL7H (ORCPT ); Mon, 21 Jun 2021 07:59:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2179661108; Mon, 21 Jun 2021 11:56:53 +0000 (UTC) Received: by mail.kernel.org with local (Exim 4.94.2) (envelope-from ) id 1lvIXr-000Hcw-2Y; Mon, 21 Jun 2021 13:56:51 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1624276613; bh=eKQAKkLLipiPydD36jq5fQOg8fFfg7eqxulZXVht4ac=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hVX9hvurJiChkgzV1uDiAOYCLzGabkN66JjHWqDHrWZd1/+WCcxVs/SH0DOxZq8Kv U+konUGRUxfz5aT4jAYSTzX7Ib0wsr3RNXx5rnV/AyiBnIL3Sy2AS5d5DaafdvTIhS kmJDIkiE2APzZ8szgzvRe5A7/f9yEE0dMG4JtooLcZpxjlRnYCouIOLXOX3tkGGaFM gd/XbSx0+DJmFK6aK9x7prjXkbuLKkdbQX42Qa535Sf5nJYwxrPvAy1cRxdKgMjNmC SNekzqR+U+TB4Y0v3nGNLQ/+vWSytzILq5eJ/nezNrSFRJ9cAIyYiH4pmtCxXalUG2 n19sCkSOiE+Sg== From: Mauro Carvalho Chehab Cc: linuxarm@huawei.com, mauro.chehab@huawei.com, Mauro Carvalho Chehab , Hugues Fruchet , Mauro Carvalho Chehab , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH 5/5] media: sti: don't copy past the size Date: Mon, 21 Jun 2021 13:56:49 +0200 Message-Id: <1c043f5c26b9cf5b4520241e2015feeae8445f58.1624276138.git.mchehab+huawei@kernel.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: Mauro Carvalho Chehab To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" The logic at delta_ipc_open() tries to copy past the size of the name passed to it: drivers/media/platform/sti/delta/delta-ipc.c:178 delta_ipc_open() error: _= _memcpy() 'name' too small (17 vs 32) Basically,this function is called just one with: ret =3D delta_ipc_open(pctx, "JPEG_DECODER_HW0", ...); The string used there has just 17 bytes. Yet, the logic tries to copy the entire name size (32 bytes), which is plain wrong. Replace it by strscpy, which is good enough to copy the string, warranting that this will be NUL-terminated. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/sti/delta/delta-ipc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/media/platform/sti/delta/delta-ipc.c b/drivers/media/p= latform/sti/delta/delta-ipc.c index 186d88f02ecd..21d3e08e259a 100644 --- a/drivers/media/platform/sti/delta/delta-ipc.c +++ b/drivers/media/platform/sti/delta/delta-ipc.c @@ -175,8 +175,7 @@ int delta_ipc_open(struct delta_ctx *pctx, const char *= name, msg.ipc_buf_size =3D ipc_buf_size; msg.ipc_buf_paddr =3D ctx->ipc_buf->paddr; =20 - memcpy(msg.name, name, sizeof(msg.name)); - msg.name[sizeof(msg.name) - 1] =3D 0; + strscpy(msg.name, name, sizeof(msg.name)); =20 msg.param_size =3D param->size; memcpy(ctx->ipc_buf->vaddr, param->data, msg.param_size); --=20 2.31.1