Re: [PATCH] ALSA: emu10k1: Pass destination size to copy_string()

[Takashi Iwai]

On Fri, 23 Oct 2026 12:50:27 +0200,
Andrey Zakharov wrote:
> 
> copy_string() copies the bus and input/output names into fixed-size
> arrays of struct snd_emu10k1_fx8010_info using strcpy() and sprintf(),
> and it has no information about the size of the destination buffer.
> 
> All source strings are static and shorter than the 32-byte destination
> arrays (the longest one is 20 characters), so this is safe today, but the
> safety should not depend on the contents of the name tables. The earlier
> strcpy() to strscpy() conversions skipped this function because dst is a
> plain pointer.
> 
> Pass the destination size to copy_string() and use strscpy() and
> snprintf() instead.
> 
> No functional changes intended.
> 
> Testing: compile-tested only with clang (W=1) and sparse (C=1). The
> function is reached only through the SNDRV_EMU10K1_IOCTL_INFO ioctl of
> the EMU10K1 hardware, which is not available under QEMU.
> 
> Link: https://github.com/KSPP/linux/issues/88
> Signed-off-by: Andrey Zakharov <dedemorow@xxxxxxxxx>

Applied now.  Thanks.


Takashi