ALSA: hda - Check strcpy length

Check the length to copy via strlen() beforehand to avoid the stack
corruption, or use strlcpy() to be safe in HD-audio codes.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

1 files changed, 6 insertions, 4 deletions

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 21a3092fad00..41db5d4da478 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1830,7 +1830,7 @@ azx_attach_pcm_stream(struct hda_bus *bus, struct hda_codec *codec,
                           &pcm);
         if (err < 0)
                 return err;
-        strcpy(pcm->name, cpcm->name);
+        strlcpy(pcm->name, cpcm->name, sizeof(pcm->name));
         apcm = kzalloc(sizeof(*apcm), GFP_KERNEL);
         if (apcm == NULL)
                 return -ENOMEM;
@@ -2358,9 +2358,11 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
         }
 
         strcpy(card->driver, "HDA-Intel");
-        strcpy(card->shortname, driver_short_names[chip->driver_type]);
-        sprintf(card->longname, "%s at 0x%lx irq %i",
-                card->shortname, chip->addr, chip->irq);
+        strlcpy(card->shortname, driver_short_names[chip->driver_type],
+                sizeof(card->shortname));
+        snprintf(card->longname, sizeof(card->longname),
+                 "%s at 0x%lx irq %i",
+                 card->shortname, chip->addr, chip->irq);
 
         *rchip = chip;
         return 0;