| Message ID | 20230114085053.72059-2-W_Armin@gmx.de |
|---|---|
| State | Accepted |
| Commit | f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc |
| Headers | show |
| Series | ACPI: battery: Fix various string handling issues | expand |
On Sat, Jan 14, 2023 at 9:51 AM Armin Wolf <W_Armin@gmx.de> wrote: > > When encountering a string bigger than the destination buffer (32 bytes), > the string is not properly NUL-terminated, causing buffer overreads later. > > This for example happens on the Inspiron 3505, where the battery > model name is larger than 32 bytes, which leads to sysfs showing > the model name together with the serial number string (which is > NUL-terminated and thus prevents worse). > > Fix this by using strscpy() which ensures that the result is > always NUL-terminated. > > Signed-off-by: Armin Wolf <W_Armin@gmx.de> > --- > drivers/acpi/battery.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c > index f4badcdde76e..fb64bd217d82 100644 > --- a/drivers/acpi/battery.c > +++ b/drivers/acpi/battery.c > @@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery, > > if (element->type == ACPI_TYPE_STRING || > element->type == ACPI_TYPE_BUFFER) > - strncpy(ptr, element->string.pointer, 32); > + strscpy(ptr, element->string.pointer, 32); > else if (element->type == ACPI_TYPE_INTEGER) { > strncpy(ptr, (u8 *)&element->integer.value, > sizeof(u64)); > -- Applied as 6.3 material, thanks! Please do not include this one in the next version of the series.
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index f4badcdde76e..fb64bd217d82 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery, if (element->type == ACPI_TYPE_STRING || element->type == ACPI_TYPE_BUFFER) - strncpy(ptr, element->string.pointer, 32); + strscpy(ptr, element->string.pointer, 32); else if (element->type == ACPI_TYPE_INTEGER) { strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64));
When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later. This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse). Fix this by using strscpy() which ensures that the result is always NUL-terminated. Signed-off-by: Armin Wolf <W_Armin@gmx.de> --- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.30.2