Skip to content

Commit ee400a1

Browse files
azeemshaikh38gregkh
authored andcommitted
usb: gadget: function: printer: Replace strlcpy with strscpy
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value of -errno is used to check for truncation instead of PAGE_SIZE. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] KSPP#89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> Link: https://lore.kernel.org/r/20230615180318.400639-1-azeemshaikh38@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 8be558d commit ee400a1

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

drivers/usb/gadget/function/f_printer.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1211,8 +1211,8 @@ static ssize_t f_printer_opts_pnp_string_show(struct config_item *item,
12111211
if (!opts->pnp_string)
12121212
goto unlock;
12131213

1214-
result = strlcpy(page, opts->pnp_string, PAGE_SIZE);
1215-
if (result >= PAGE_SIZE) {
1214+
result = strscpy(page, opts->pnp_string, PAGE_SIZE);
1215+
if (result < 1) {
12161216
result = PAGE_SIZE;
12171217
} else if (page[result - 1] != '\n' && result + 1 < PAGE_SIZE) {
12181218
page[result++] = '\n';

0 commit comments

Comments
 (0)