[PATCH 6/7] ALSA: hiface: replace strlcat() with scnprintf()

[Mahad Ibrahim]

card->longname was built with two strlcat() calls, one copying
card->shortname and one appending " at ". The return value of the
second gave the offset that usb_make_path() writes at.

card->longname is empty here. snd_card_new() allocates struct
snd_card with kzalloc() and nothing writes longname before this
point, so the first strlcat() is really a copy and the two calls
collapse into one scnprintf().

len now counts the characters actually written rather than the
characters requested, so the bounds check below it is always true and
usb_make_path() is reached even when the name was truncated. In that
case it is given a size of one and writes only the NUL terminator
that scnprintf() already placed there, so longname does not change.
Truncation cannot happen in practice anyway: shortname is 32 bytes
and longname is 80.

Signed-off-by: Mahad Ibrahim <mahad.ibrahim.dev@xxxxxxxxx>
---
 sound/usb/hiface/chip.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/usb/hiface/chip.c b/sound/usb/hiface/chip.c
index bce28f683666..d217fe64eabd 100644
--- a/sound/usb/hiface/chip.c
+++ b/sound/usb/hiface/chip.c
@@ -70,8 +70,8 @@ static int hiface_chip_create(struct usb_interface *intf,
 	else
 		strscpy(card->shortname, "M2Tech generic audio", sizeof(card->shortname));
 
-	strlcat(card->longname, card->shortname, sizeof(card->longname));
-	len = strlcat(card->longname, " at ", sizeof(card->longname));
+	len = scnprintf(card->longname, sizeof(card->longname), "%s at ",
+			card->shortname);
 	if (len < sizeof(card->longname))
 		usb_make_path(device, card->longname + len,
 			      sizeof(card->longname) - len);
-- 
2.54.0