Commit fa8db398 authored by Len Baker's avatar Len Baker Committed by Greg Kroah-Hartman
Browse files

staging/most: Remove all strcpy() uses in favor of strscpy() 



strcpy() performs no bounds checking on the destination buffer. This
could result in linear overflows beyond the end of the buffer, leading
to all kinds of misbehaviors. The safe replacement is strscpy().

Signed-off-by: default avatarLen Baker <len.baker@gmx.com>
Link: https://lore.kernel.org/r/20210717160512.16176-1-len.baker@gmx.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 56315e55

drivers/staging/most/video/video.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -258,7 +258,7 @@ static int vidioc_enum_fmt_vid_cap(struct file *file, void *priv, 
	if (f->index)

	if (f->index)

		return -EINVAL;

		return -EINVAL;





	strcpy(f->description, "MPEG");

	strscpy(f->description, "MPEG", sizeof(f->description));

	f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;

	f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;

	f->flags = V4L2_FMT_FLAG_COMPRESSED;

	f->flags = V4L2_FMT_FLAG_COMPRESSED;

	f->pixelformat = V4L2_PIX_FMT_MPEG;

	f->pixelformat = V4L2_PIX_FMT_MPEG;
@@ -306,7 +306,7 @@ static int vidioc_enum_input(struct file *file, void *priv, 
	if (input->index >= V4L2_CMP_MAX_INPUT)

	if (input->index >= V4L2_CMP_MAX_INPUT)

		return -EINVAL;

		return -EINVAL;





	strcpy(input->name, "MOST Video");

	strscpy(input->name, "MOST Video", sizeof(input->name));

	input->type |= V4L2_INPUT_TYPE_CAMERA;

	input->type |= V4L2_INPUT_TYPE_CAMERA;

	input->audioset = 0;

	input->audioset = 0;