Commit ea08c6fa authored by Dmitry Torokhov's avatar Dmitry Torokhov
Browse files

Input: fix potential overflows in driver/input/keyboard 



Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
parent a21466cc

drivers/input/keyboard/atkbd.c

+7 −4
Original line number Diff line number Diff line
@@ -776,12 +776,15 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd) 
	int i;



	if (atkbd->extra)

		sprintf(atkbd->name, "AT Set 2 Extra keyboard");

		snprintf(atkbd->name, sizeof(atkbd->name),

			 "AT Set 2 Extra keyboard");

	else

		sprintf(atkbd->name, "AT %s Set %d keyboard",

		snprintf(atkbd->name, sizeof(atkbd->name),

			 "AT %s Set %d keyboard",

			 atkbd->translated ? "Translated" : "Raw", atkbd->set);



	sprintf(atkbd->phys, "%s/input0", atkbd->ps2dev.serio->phys);

	snprintf(atkbd->phys, sizeof(atkbd->phys),

		 "%s/input0", atkbd->ps2dev.serio->phys);



	input_dev->name = atkbd->name;

	input_dev->phys = atkbd->phys;

drivers/input/keyboard/lkkbd.c

+6 −3
Original line number Diff line number Diff line
@@ -384,18 +384,21 @@ lkkbd_detection_done (struct lkkbd *lk) 
	 */

	switch (lk->id[4]) {

		case 1:

			sprintf (lk->name, "DEC LK201 keyboard");

			strlcpy (lk->name, "DEC LK201 keyboard",

				 sizeof (lk->name));



			if (lk201_compose_is_alt)

				lk->keycode[0xb1] = KEY_LEFTALT;

			break;



		case 2:

			sprintf (lk->name, "DEC LK401 keyboard");

			strlcpy (lk->name, "DEC LK401 keyboard",

				 sizeof (lk->name));

			break;



		default:

			sprintf (lk->name, "Unknown DEC keyboard");

			strlcpy (lk->name, "Unknown DEC keyboard",

				 sizeof (lk->name));

			printk (KERN_ERR "lkkbd: keyboard on %s is unknown, "

					"please report to Jan-Benedict Glaw "

					"<jbglaw@lug-owl.de>\n", lk->phys);

drivers/input/keyboard/newtonkbd.c

+1 −1
Original line number Diff line number Diff line
@@ -96,7 +96,7 @@ static int nkbd_connect(struct serio *serio, struct serio_driver *drv) 


	nkbd->serio = serio;

	nkbd->dev = input_dev;

	sprintf(nkbd->phys, "%s/input0", serio->phys);

	snprintf(nkbd->phys, sizeof(nkbd->phys), "%s/input0", serio->phys);

	memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode));



	input_dev->name = "Newton Keyboard";

drivers/input/keyboard/sunkbd.c

+1 −1
Original line number Diff line number Diff line
@@ -263,7 +263,7 @@ static int sunkbd_connect(struct serio *serio, struct serio_driver *drv) 
		goto fail;

	}



	sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type);

	snprintf(sunkbd->name, sizeof(sunkbd->name), "Sun Type %d keyboard", sunkbd->type);

	memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));



	input_dev->name = sunkbd->name;

drivers/input/keyboard/xtkbd.c

+1 −1
Original line number Diff line number Diff line
@@ -100,7 +100,7 @@ static int xtkbd_connect(struct serio *serio, struct serio_driver *drv) 


	xtkbd->serio = serio;

	xtkbd->dev = input_dev;

	sprintf(xtkbd->phys, "%s/input0", serio->phys);

	snprintf(xtkbd->phys, sizeof(xtkbd->phys), "%s/input0", serio->phys);

	memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode));



	input_dev->name = "XT Keyboard";

CRA Git | Maintained and supported by SUSTech CRA and CCSE