public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup()
@ 2026-02-04 12:05 Artem Lytkin
  2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
                   ` (4 more replies)
  0 siblings, 5 replies; 8+ messages in thread
From: Artem Lytkin @ 2026-02-04 12:05 UTC (permalink / raw)
  To: Sudip Mukherjee, Teddy Wang, Greg Kroah-Hartman
  Cc: linux-fbdev, linux-staging, linux-kernel, Artem Lytkin

As part of kernel hardening, I am auditing calls to strcat().  This
code works but it is a bit ugly.

This function takes a string "options" and allocates "g_settings"
which is large enough to hold a copy of "options".  It copies all the
options from "options" to "g_settings" except "noaccel", "nomtrr" and
"dual".  The new buffer is large enough to fit all the options so
there is no buffer overflow in using strcat() here.

However, using strcat() is misleading because "tmp" always points
to the next unused character in the "g_settings" buffer and it's
always the NUL character.  Use memcpy() instead to make the code
easier to read.  This also removes an instance of strcat() which
is a #NiceBonus.

Signed-off-by: Artem Lytkin <iprintercanon@gmail.com>
---
 drivers/staging/sm750fb/sm750.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index fecd7457e..4c6e84c03 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -1163,7 +1163,7 @@ static int __init lynxfb_setup(char *options)
 		} else if (!strncmp(opt, "dual", strlen("dual"))) {
 			g_dualview = 1;
 		} else {
-			strcat(tmp, opt);
+			memcpy(tmp, opt, strlen(opt));
 			tmp += strlen(opt);
 			if (options)
 				*tmp++ = ':';
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2026-02-07 13:32 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-04 12:05 [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Artem Lytkin
2026-02-04 12:05 ` [PATCH v3 2/5] staging: sm750fb: use strcmp() for exact option matching Artem Lytkin
2026-02-07 13:31   ` Greg Kroah-Hartman
2026-02-04 12:06 ` [PATCH v3 3/5] staging: sm750fb: remove debug and diagnostic prints Artem Lytkin
2026-02-07 13:32   ` Greg Kroah-Hartman
2026-02-04 12:06 ` [PATCH v3 4/5] staging: sm750fb: convert logging to device-based in sm750.c Artem Lytkin
2026-02-04 12:06 ` [PATCH v3 5/5] staging: sm750fb: convert logging to device-based in sm750_hw.c Artem Lytkin
2026-02-07 13:27 ` [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup() Greg Kroah-Hartman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox