Re: [PATCH] ALSA: wavefront: fix buffer overflow in longname construction

[Takashi Iwai <tiwai@suse.de>]

On Tue, 28 Oct 2025 17:26:43 +0100,
moonafterrain@outlook.com wrote:
> 
> From: Junrui Luo <moonafterrain@outlook.com>
> 
> The snd_wavefront_probe() function constructs the card->longname string
> using unsafe sprintf() calls that can overflow the 80-byte buffer when
> module parameters contain large values.
> 
> The vulnerability exists at wavefront.c where multiple sprintf()
> operations append to card->longname without length checking.
> 
> Fix by replacing all sprintf() calls with scnprintf() and proper length
> tracking to ensure writes never exceed sizeof(card->longname).
> 
> Reported-by: Yuhao Jiang <danisjiang@gmail.com>
> Reported-by: Junrui Luo <moonafterrain@outlook.com>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
> ---
>  sound/isa/wavefront/wavefront.c | 40 ++++++++++++++++++++-------------
>  1 file changed, 25 insertions(+), 15 deletions(-)
> 
> diff --git a/sound/isa/wavefront/wavefront.c b/sound/isa/wavefront/wavefront.c
> index 07c68568091d..74ea3a67620c 100644
> --- a/sound/isa/wavefront/wavefront.c
> +++ b/sound/isa/wavefront/wavefront.c
> @@ -343,6 +343,7 @@ snd_wavefront_probe (struct snd_card *card, int dev)
>  	struct snd_rawmidi *ics2115_external_rmidi = NULL;
>  	struct snd_hwdep *fx_processor;
>  	int hw_dev = 0, midi_dev = 0, err;
> +	size_t len, rem;
>  
>  	/* --------- PCM --------------- */
>  
> @@ -492,26 +493,35 @@ snd_wavefront_probe (struct snd_card *card, int dev)
>  	   length restrictions
>  	*/
>  
> -	sprintf(card->longname, "%s PCM 0x%lx irq %d dma %d",
> -		card->driver,
> -		chip->port,
> -		cs4232_pcm_irq[dev],
> -		dma1[dev]);
> +	len = scnprintf(card->longname, sizeof(card->longname),
> +			"%s PCM 0x%lx irq %d dma %d",
> +			card->driver,
> +			chip->port,
> +			cs4232_pcm_irq[dev],
> +			dma1[dev]);
>  
> -	if (dma2[dev] >= 0 && dma2[dev] < 8)
> -		sprintf(card->longname + strlen(card->longname), "&%d", dma2[dev]);
> +	if (dma2[dev] >= 0 && dma2[dev] < 8 && len < sizeof(card->longname)) {
> +		rem = sizeof(card->longname) - len;
> +		len += scnprintf(card->longname + len, rem, "&%d", dma2[dev]);
> +	}
>  
>  	if (cs4232_mpu_port[dev] > 0 && cs4232_mpu_port[dev] != SNDRV_AUTO_PORT) {
> -		sprintf (card->longname + strlen (card->longname), 
> -			 " MPU-401 0x%lx irq %d",
> -			 cs4232_mpu_port[dev],
> -			 cs4232_mpu_irq[dev]);
> +		if (len < sizeof(card->longname)) {
> +			rem = sizeof(card->longname) - len;
> +			len += scnprintf(card->longname + len, rem,
> +					 " MPU-401 0x%lx irq %d",
> +					 cs4232_mpu_port[dev],
> +					 cs4232_mpu_irq[dev]);
> +		}
>  	}
>  
> -	sprintf (card->longname + strlen (card->longname), 
> -		 " SYNTH 0x%lx irq %d",
> -		 ics2115_port[dev],
> -		 ics2115_irq[dev]);
> +	if (len < sizeof(card->longname)) {
> +		rem = sizeof(card->longname) - len;
> +		scnprintf(card->longname + len, rem,
> +			  " SYNTH 0x%lx irq %d",
> +			  ics2115_port[dev],
> +			  ics2115_irq[dev]);
> +	}
>  
>  	return snd_card_register(card);
>  }	

Thanks for the patch.  But the code change is way too complex for the
gain it can have.

There can't be any overflow in the current code as is, because the
buffer size is large enough.  snd_card.longname[] is 80 bytes, hence
even if you count all other fields, it can't overflow, practically
seen.

If the code change were trivial, such a fix would still make sense.
But the proposed patch makes the code just harder to understand and
more error-prone.

If you're still interested in "fixing" such cases, I guess we may
introduce a new helper to append a format string, e.g.

int scnprintf_append(char *buf, size_t size, const char *fmt, ...)
{
	va_list args;
	size_t len = strlen(buf);

	if (len >= size)
		return len;
	va_start(args, fmt);
	len = vscnprintf(buf + len, size - len, fmt, args);
	va_end(args);
	return len;
}

Then the rest change would be really trivial, just to replace the
snprintf(buf + strlen()) with this new function call.  There seem many
other codes doing the similar things, and they can be replaced
gracefully, too.


thanks,

Takashi