From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9FBC352084; Tue, 26 Aug 2025 14:39:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756219191; cv=none; b=H2rE4EL49TQ21m7a+i2EdQF8+kPEiE3x4l4/J3S8yVbdYv3mEWBsx+xbWOy83HTtBDLlJy3lsEPD0oD7+jBTYj6NFvC1scjzu7mX4Dj+5Z7h912e4bqLJ9QG4cOYGK0fBFuJUgYFs3J2TbIFqAI0epI7q8kXx90dmiFro8ulxXQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756219191; c=relaxed/simple; bh=wn/GhMAKteOo4etVudQx1DZkn3IojmXbh707384kfAo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e2RX/bbTDpLPrVC56ePtvQ/ribvW43XESYelQixUvJCfxM/z0js6Za+Txbdscyvb7sH0GFZpMZADYKuwGxSmDv6n3Vs4o1m98fZE8KAExl44jdqsTEK7IMw5AfzfKW8kNeO7UbS3XJBlRfxGrRs/gLvRtxHD2vMs1CIz+7/fKow= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vQshWgj7; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="vQshWgj7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79BCDC4CEF1; Tue, 26 Aug 2025 14:39:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1756219190; bh=wn/GhMAKteOo4etVudQx1DZkn3IojmXbh707384kfAo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vQshWgj7rQIabh9+bdNH+fHXLdVxJJipFp/brQlU8MhaLC0175Lm+XHQN2OkTM//g kOME6ICul3hYpM0Sq6Pb8rKgbY8zooSqknPESglrTKLzEpt6LuS+WPuraNGbtWshv3 5E94Cbj/ZUCHd/3uLkfSOkWdHCey2dWRELAqK4Yk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Suchit Karunakaran , Nicolas Schier , Masahiro Yamada , Sasha Levin Subject: [PATCH 5.4 257/403] kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c Date: Tue, 26 Aug 2025 13:09:43 +0200 Message-ID: <20250826110913.922202113@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250826110905.607690791@linuxfoundation.org> References: <20250826110905.607690791@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Suchit Karunakaran [ Upstream commit 5ac726653a1029a2eccba93bbe59e01fc9725828 ] strcpy() performs no bounds checking and can lead to buffer overflows if the input string exceeds the destination buffer size. This patch replaces it with strncpy(), and null terminates the input string. Signed-off-by: Suchit Karunakaran Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada Signed-off-by: Sasha Levin --- scripts/kconfig/lxdialog/inputbox.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c index 1dcfb288ee63..327b60cdb8da 100644 --- a/scripts/kconfig/lxdialog/inputbox.c +++ b/scripts/kconfig/lxdialog/inputbox.c @@ -39,8 +39,10 @@ int dialog_inputbox(const char *title, const char *prompt, int height, int width if (!init) instr[0] = '\0'; - else - strcpy(instr, init); + else { + strncpy(instr, init, sizeof(dialog_input_result) - 1); + instr[sizeof(dialog_input_result) - 1] = '\0'; + } do_resize: if (getmaxy(stdscr) <= (height - INPUTBOX_HEIGTH_MIN)) -- 2.39.5