strcpy() has no notion of the destination buffer's size, so it will
write past the end of fb_helper->fb->comm if the source string is
ever longer than expected. It isn't here today ("[fbcon]" always
fits), but strscpy() is the bounded, always-NUL-terminating
replacement recommended for all new and existing strcpy() users, so
convert this one too. fb->comm is a fixed-size array, so the
destination size can be derived automatically.No functional change. Signed-off-by: Hrushiraj Gandhi <[email protected]> --- drivers/gpu/drm/drm_fb_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index 80ca785bdb26..175311fac2e4 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -1545,7 +1545,7 @@ static int drm_fb_helper_single_fb_probe(struct drm_fb_helper *fb_helper) if (ret < 0) return ret; - strcpy(fb_helper->fb->comm, "[fbcon]"); + strscpy(fb_helper->fb->comm, "[fbcon]"); return 0; }
