strcpy() performs no bounds checking on the destination buffer. len.baker@xxxxxxx/
@@ -1113,12 +1115,9 @@ void edac_mc_handle_error(const enum
hw_event_mc_err_type type,
p = e->label;
*p = '\0';
} else {
- if (p != e->label) {
- strcpy(p, OTHER_LABEL);
- p += strlen(OTHER_LABEL);
- }
- strcpy(p, dimm->label);
- p += strlen(p);
+ n += scnprintf(e->label + n, sizeof(e->label) - n,
+ "%s%s", prefix, dimm->label);
+ prefix = OTHER_LABEL;