linux-kernel - [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260204120602.6715-1-iprintercanon@gmail.com>
Date: Wed,  4 Feb 2026 12:05:58 +0000
From: Artem Lytkin <iprintercanon@...il.com>
To: Sudip Mukherjee <sudipm.mukherjee@...il.com>,
	Teddy Wang <teddy.wang@...iconmotion.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: linux-fbdev@...r.kernel.org,
	linux-staging@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	Artem Lytkin <iprintercanon@...il.com>
Subject: [PATCH v3 1/5] staging: sm750fb: replace strcat() with memcpy() in lynxfb_setup()

As part of kernel hardening, I am auditing calls to strcat().  This
code works but it is a bit ugly.

This function takes a string "options" and allocates "g_settings"
which is large enough to hold a copy of "options".  It copies all the
options from "options" to "g_settings" except "noaccel", "nomtrr" and
"dual".  The new buffer is large enough to fit all the options so
there is no buffer overflow in using strcat() here.

However, using strcat() is misleading because "tmp" always points
to the next unused character in the "g_settings" buffer and it's
always the NUL character.  Use memcpy() instead to make the code
easier to read.  This also removes an instance of strcat() which
is a #NiceBonus.

Signed-off-by: Artem Lytkin <iprintercanon@...il.com>
---
 drivers/staging/sm750fb/sm750.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index fecd7457e..4c6e84c03 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -1163,7 +1163,7 @@ static int __init lynxfb_setup(char *options)
 		} else if (!strncmp(opt, "dual", strlen("dual"))) {
 			g_dualview = 1;
 		} else {
-			strcat(tmp, opt);
+			memcpy(tmp, opt, strlen(opt));
 			tmp += strlen(opt);
 			if (options)
 				*tmp++ = ':';
-- 
2.43.0