summaryrefslogtreecommitdiff
path: root/drivers/acpi
diff options
context:
space:
mode:
authorArmin Wolf <W_Armin@gmx.de>2023-01-14 11:50:50 +0300
committerRafael J. Wysocki <rafael.j.wysocki@intel.com>2023-01-18 22:52:05 +0300
commitf2ac14b5f197e4a2dec51e5ceaa56682ff1592bc (patch)
tree506aadf715cd98a2446be771261a407470d6fc46 /drivers/acpi
parent5dc4c995db9eb45f6373a956eb1f69460e69e6d4 (diff)
downloadlinux-f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc.tar.xz
ACPI: battery: Fix missing NUL-termination with large strings
When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later. This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse). Fix this by using strscpy() which ensures that the result is always NUL-terminated. Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") Signed-off-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Diffstat (limited to 'drivers/acpi')
-rw-r--r--drivers/acpi/battery.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index f4badcdde76e..fb64bd217d82 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery,
if (element->type == ACPI_TYPE_STRING ||
element->type == ACPI_TYPE_BUFFER)
- strncpy(ptr, element->string.pointer, 32);
+ strscpy(ptr, element->string.pointer, 32);
else if (element->type == ACPI_TYPE_INTEGER) {
strncpy(ptr, (u8 *)&element->integer.value,
sizeof(u64));