public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Input: fix potential overflows in driver/input/keyboard

Browse source 
Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
This commit is contained in:
Dmitry Torokhov 2006-06-26 01:46:17 -04:00
parent a21466cc77
commit ea08c6faa0
5 changed files with 16 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/input/keyboard/atkbd.c
View file

@ -776,12 +776,15 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd)
int i; int i;
if (atkbd->extra) if (atkbd->extra)
sprintf(atkbd->name, "AT Set 2 Extra keyboard"); snprintf(atkbd->name, sizeof(atkbd->name),
"AT Set 2 Extra keyboard");
else else
sprintf(atkbd->name, "AT %s Set %d keyboard", snprintf(atkbd->name, sizeof(atkbd->name),
atkbd->translated ? "Translated" : "Raw", atkbd->set); "AT %s Set %d keyboard",
atkbd->translated ? "Translated" : "Raw", atkbd->set);
sprintf(atkbd->phys, "%s/input0", atkbd->ps2dev.serio->phys); snprintf(atkbd->phys, sizeof(atkbd->phys),
"%s/input0", atkbd->ps2dev.serio->phys);
input_dev->name = atkbd->name; input_dev->name = atkbd->name;
input_dev->phys = atkbd->phys; input_dev->phys = atkbd->phys;

9
drivers/input/keyboard/lkkbd.c
View file

@ -384,18 +384,21 @@ lkkbd_detection_done (struct lkkbd *lk)
*/ */
switch (lk->id[4]) { switch (lk->id[4]) {
case 1: case 1:
sprintf (lk->name, "DEC LK201 keyboard"); strlcpy (lk->name, "DEC LK201 keyboard",
sizeof (lk->name));
if (lk201_compose_is_alt) if (lk201_compose_is_alt)
lk->keycode[0xb1] = KEY_LEFTALT; lk->keycode[0xb1] = KEY_LEFTALT;
break; break;
case 2: case 2:
sprintf (lk->name, "DEC LK401 keyboard"); strlcpy (lk->name, "DEC LK401 keyboard",
sizeof (lk->name));
break; break;
default: default:
sprintf (lk->name, "Unknown DEC keyboard"); strlcpy (lk->name, "Unknown DEC keyboard",
sizeof (lk->name));
printk (KERN_ERR "lkkbd: keyboard on %s is unknown, " printk (KERN_ERR "lkkbd: keyboard on %s is unknown, "
"please report to Jan-Benedict Glaw " "please report to Jan-Benedict Glaw "
"<jbglaw@lug-owl.de>\n", lk->phys); "<jbglaw@lug-owl.de>\n", lk->phys);

2
drivers/input/keyboard/newtonkbd.c
View file

@ -96,7 +96,7 @@ static int nkbd_connect(struct serio *serio, struct serio_driver *drv)
nkbd->serio = serio; nkbd->serio = serio;
nkbd->dev = input_dev; nkbd->dev = input_dev;
sprintf(nkbd->phys, "%s/input0", serio->phys); snprintf(nkbd->phys, sizeof(nkbd->phys), "%s/input0", serio->phys);
memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode)); memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode));
input_dev->name = "Newton Keyboard"; input_dev->name = "Newton Keyboard";

2
drivers/input/keyboard/sunkbd.c
View file

@ -263,7 +263,7 @@ static int sunkbd_connect(struct serio *serio, struct serio_driver *drv)
goto fail; goto fail;
} }
sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type); snprintf(sunkbd->name, sizeof(sunkbd->name), "Sun Type %d keyboard", sunkbd->type);
memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode)); memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));
input_dev->name = sunkbd->name; input_dev->name = sunkbd->name;

2
drivers/input/keyboard/xtkbd.c
View file

@ -100,7 +100,7 @@ static int xtkbd_connect(struct serio *serio, struct serio_driver *drv)
xtkbd->serio = serio; xtkbd->serio = serio;
xtkbd->dev = input_dev; xtkbd->dev = input_dev;
sprintf(xtkbd->phys, "%s/input0", serio->phys); snprintf(xtkbd->phys, sizeof(xtkbd->phys), "%s/input0", serio->phys);
memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode)); memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode));
input_dev->name = "XT Keyboard"; input_dev->name = "XT Keyboard";