linux-kernel - [PATCH] tools/power/acpi: Replace strcpy/strcat with snprintf in osunixdir.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260201181620.4964-1-sumeet4linux@gmail.com>
Date: Sun,  1 Feb 2026 23:46:20 +0530
From: Sumeet Pawnikar <sumeet4linux@...il.com>
To: rafael@...nel.org,
	robert.moore@...el.com,
	lenb@...nel.org,
	linux-acpi@...r.kernel.org,
	acpica-devel@...ts.linux.dev
Cc: linux-kernel@...r.kernel.org,
	sumeet4linux@...il.com
Subject: [PATCH] tools/power/acpi: Replace strcpy/strcat with snprintf in osunixdir.c

Replace unsafe strcpy() and strcat() calls with snprintf() in
osunixdir.c to prevent potential buffer overflow vulnerabilities
when constructing file paths.

The snprintf() function performs automatic bounds checking to ensure
the destination buffer is not overflowed.

No functional change.

Signed-off-by: Sumeet Pawnikar <sumeet4linux@...il.com>
---
 .../power/acpi/os_specific/service_layers/osunixdir.c  | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tools/power/acpi/os_specific/service_layers/osunixdir.c b/tools/power/acpi/os_specific/service_layers/osunixdir.c
index b9bb83116549..5dc960c6b376 100644
--- a/tools/power/acpi/os_specific/service_layers/osunixdir.c
+++ b/tools/power/acpi/os_specific/service_layers/osunixdir.c
@@ -113,9 +113,8 @@ char *acpi_os_get_next_filename(void *dir_handle)
 				return (NULL);
 			}
 
-			strcpy(temp_str, external_info->dir_pathname);
-			strcat(temp_str, "/");
-			strcat(temp_str, dir_entry->d_name);
+			snprintf(temp_str, str_len, "%s/%s",
+				 external_info->dir_pathname, dir_entry->d_name);
 
 			err = stat(temp_str, &temp_stat);
 			if (err == -1) {
@@ -137,8 +136,9 @@ char *acpi_os_get_next_filename(void *dir_handle)
 
 				/* copy to a temp buffer because dir_entry struct is on the stack */
 
-				strcpy(external_info->temp_buffer,
-				       dir_entry->d_name);
+				snprintf(external_info->temp_buffer,
+					 sizeof(external_info->temp_buffer),
+					 "%s", dir_entry->d_name);
 				return (external_info->temp_buffer);
 			}
 		}
-- 
2.43.0