V4L/DVB (10293): uvcvideo: replace strn{cpy,cat} with strl{cpy,cat}.

strncpy is unsafe as it doesn't append a terminating NUL character when the
source string doesn't fit in the destination buffer. Replace it with strlcpy.
strncat is misused as its size argument refers to the source string, not the
destination buffer. Replace it with strlcat.

Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index d2576f6391c06f4c643c96f9b0ffc0051e5fa124..0d7e38d6ff6a416ed6905b9bb66d6b3f6f2dd2f6 100644 (file)
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -786,7 +786,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video_device *video,
        memset(v4l2_ctrl, 0, sizeof *v4l2_ctrl);
        v4l2_ctrl->id = mapping->id;
        v4l2_ctrl->type = mapping->v4l2_type;
-       strncpy(v4l2_ctrl->name, mapping->name, sizeof v4l2_ctrl->name);
+       strlcpy(v4l2_ctrl->name, mapping->name, sizeof v4l2_ctrl->name);
        v4l2_ctrl->flags = 0;
 
        if (!(ctrl->info->flags & UVC_CONTROL_SET_CUR))

diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index b12873265cc56c5c811a6cba514305f8e6534a3d..6dba5ead88362ea4bf3f952cf01b5b441a8e5e61 100644 (file)
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -314,7 +314,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                fmtdesc = uvc_format_by_guid(&buffer[5]);
 
                if (fmtdesc != NULL) {
-                       strncpy(format->name, fmtdesc->name,
+                       strlcpy(format->name, fmtdesc->name,
                                sizeof format->name);
                        format->fcc = fmtdesc->fcc;
                } else {
@@ -345,7 +345,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                        return -EINVAL;
                }
 
-               strncpy(format->name, "MJPEG", sizeof format->name);
+               strlcpy(format->name, "MJPEG", sizeof format->name);
                format->fcc = V4L2_PIX_FMT_MJPEG;
                format->flags = UVC_FMT_FLAG_COMPRESSED;
                format->bpp = 0;
@@ -363,13 +363,13 @@ static int uvc_parse_format(struct uvc_device *dev,
 
                switch (buffer[8] & 0x7f) {
                case 0:
-                       strncpy(format->name, "SD-DV", sizeof format->name);
+                       strlcpy(format->name, "SD-DV", sizeof format->name);
                        break;
                case 1:
-                       strncpy(format->name, "SDL-DV", sizeof format->name);
+                       strlcpy(format->name, "SDL-DV", sizeof format->name);
                        break;
                case 2:
-                       strncpy(format->name, "HD-DV", sizeof format->name);
+                       strlcpy(format->name, "HD-DV", sizeof format->name);
                        break;
                default:
                        uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming"
@@ -379,7 +379,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                        return -EINVAL;
                }
 
-               strncat(format->name, buffer[8] & (1 << 7) ? " 60Hz" : " 50Hz",
+               strlcat(format->name, buffer[8] & (1 << 7) ? " 60Hz" : " 50Hz",
                        sizeof format->name);
 
                format->fcc = V4L2_PIX_FMT_DV;
@@ -1526,7 +1526,7 @@ static int uvc_register_video(struct uvc_device *dev)
        vdev->minor = -1;
        vdev->fops = &uvc_fops;
        vdev->release = video_device_release;
-       strncpy(vdev->name, dev->name, sizeof vdev->name);
+       strlcpy(vdev->name, dev->name, sizeof vdev->name);
 
        /* Set the driver data before calling video_register_device, otherwise
         * uvc_v4l2_open might race us.
@@ -1621,7 +1621,7 @@ static int uvc_probe(struct usb_interface *intf,
        dev->quirks = id->driver_info | uvc_quirks_param;
 
        if (udev->product != NULL)
-               strncpy(dev->name, udev->product, sizeof dev->name);
+               strlcpy(dev->name, udev->product, sizeof dev->name);
        else
                snprintf(dev->name, sizeof dev->name,
                        "UVC Camera (%04x:%04x)",

diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index d681519d0c8ae1ffa380352f85819c59ee44450f..011ebd4da44a3b59e29b53f58243511caf0c9dcc 100644 (file)
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -55,7 +55,7 @@ static int uvc_v4l2_query_menu(struct uvc_video_device *video,
                return -EINVAL;
 
        menu_info = &mapping->menu_info[query_menu->index];
-       strncpy(query_menu->name, menu_info->name, 32);
+       strlcpy(query_menu->name, menu_info->name, sizeof query_menu->name);
        return 0;
 }
 
@@ -486,9 +486,9 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
                struct v4l2_capability *cap = arg;
 
                memset(cap, 0, sizeof *cap);
-               strncpy(cap->driver, "uvcvideo", sizeof cap->driver);
-               strncpy(cap->card, vdev->name, 32);
-               strncpy(cap->bus_info, video->dev->udev->bus->bus_name,
+               strlcpy(cap->driver, "uvcvideo", sizeof cap->driver);
+               strlcpy(cap->card, vdev->name, sizeof cap->card);
+               strlcpy(cap->bus_info, video->dev->udev->bus->bus_name,
                        sizeof cap->bus_info);
                cap->version = DRIVER_VERSION_NUMBER;
                if (video->streaming->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
@@ -620,7 +620,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 
                memset(input, 0, sizeof *input);
                input->index = index;
-               strncpy(input->name, iterm->name, sizeof input->name);
+               strlcpy(input->name, iterm->name, sizeof input->name);
                if (UVC_ENTITY_TYPE(iterm) == ITT_CAMERA)
                        input->type = V4L2_INPUT_TYPE_CAMERA;
                break;
@@ -682,7 +682,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
                fmt->flags = 0;
                if (format->flags & UVC_FMT_FLAG_COMPRESSED)
                        fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
-               strncpy(fmt->description, format->name,
+               strlcpy(fmt->description, format->name,
                        sizeof fmt->description);
                fmt->description[sizeof fmt->description - 1] = 0;
                fmt->pixelformat = format->fcc;