diff options
author | Dmitry Torokhov <dtor_core@ameritech.net> | 2006-06-26 05:45:10 (GMT) |
---|---|---|
committer | Dmitry Torokhov <dtor_core@ameritech.net> | 2006-06-26 05:45:10 (GMT) |
commit | 08ffce4560e0133e10634b0dd85eecee11257a1c (patch) | |
tree | eff2a0266e0897e72e48db949fb28f367812222e /drivers | |
parent | 4854c7b27f0975a2b629f35ea3996d2968eb7c4f (diff) | |
download | linux-fsl-qoriq-08ffce4560e0133e10634b0dd85eecee11257a1c.tar.xz |
Input: fix potential overflows in driver/input/mouse
Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.
Noticed by Wouter Paesen <wouter@kangaroot.net>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/input/mouse/alps.c | 2 | ||||
-rw-r--r-- | drivers/input/mouse/psmouse-base.c | 6 | ||||
-rw-r--r-- | drivers/input/mouse/sermouse.c | 2 | ||||
-rw-r--r-- | drivers/input/mouse/vsxxxaa.c | 22 |
4 files changed, 18 insertions, 14 deletions
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c index a0e2e79..070d753 100644 --- a/drivers/input/mouse/alps.c +++ b/drivers/input/mouse/alps.c @@ -470,7 +470,7 @@ int alps_init(struct psmouse *psmouse) dev1->keybit[LONG(BTN_BACK)] |= BIT(BTN_BACK); } - sprintf(priv->phys, "%s/input1", psmouse->ps2dev.serio->phys); + snprintf(priv->phys, sizeof(priv->phys), "%s/input1", psmouse->ps2dev.serio->phys); dev2->phys = priv->phys; dev2->name = (priv->i->flags & ALPS_DUALPOINT) ? "DualPoint Stick" : "PS/2 Mouse"; dev2->id.bustype = BUS_I8042; diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c index 136321a..5f21532 100644 --- a/drivers/input/mouse/psmouse-base.c +++ b/drivers/input/mouse/psmouse-base.c @@ -1057,8 +1057,8 @@ static int psmouse_switch_protocol(struct psmouse *psmouse, struct psmouse_proto if (psmouse->resync_time && psmouse->poll(psmouse)) psmouse->resync_time = 0; - sprintf(psmouse->devname, "%s %s %s", - psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name); + snprintf(psmouse->devname, sizeof(psmouse->devname), "%s %s %s", + psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name); input_dev->name = psmouse->devname; input_dev->phys = psmouse->phys; @@ -1099,7 +1099,7 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv) ps2_init(&psmouse->ps2dev, serio); INIT_WORK(&psmouse->resync_work, psmouse_resync, psmouse); psmouse->dev = input_dev; - sprintf(psmouse->phys, "%s/input0", serio->phys); + snprintf(psmouse->phys, sizeof(psmouse->phys), "%s/input0", serio->phys); psmouse_set_state(psmouse, PSMOUSE_INITIALIZING); diff --git a/drivers/input/mouse/sermouse.c b/drivers/input/mouse/sermouse.c index 2f9a04a..a897424 100644 --- a/drivers/input/mouse/sermouse.c +++ b/drivers/input/mouse/sermouse.c @@ -254,7 +254,7 @@ static int sermouse_connect(struct serio *serio, struct serio_driver *drv) goto fail; sermouse->dev = input_dev; - sprintf(sermouse->phys, "%s/input0", serio->phys); + snprintf(sermouse->phys, sizeof(sermouse->phys), "%s/input0", serio->phys); sermouse->type = serio->id.proto; input_dev->name = sermouse_protocols[sermouse->type]; diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c index 36e9442..7b85bc2 100644 --- a/drivers/input/mouse/vsxxxaa.c +++ b/drivers/input/mouse/vsxxxaa.c @@ -153,22 +153,25 @@ vsxxxaa_detection_done (struct vsxxxaa *mouse) { switch (mouse->type) { case 0x02: - sprintf (mouse->name, "DEC VSXXX-AA/-GA mouse"); + strlcpy (mouse->name, "DEC VSXXX-AA/-GA mouse", + sizeof (mouse->name)); break; case 0x04: - sprintf (mouse->name, "DEC VSXXX-AB digitizer"); + strlcpy (mouse->name, "DEC VSXXX-AB digitizer", + sizeof (mouse->name)); break; default: - sprintf (mouse->name, "unknown DEC pointer device " - "(type = 0x%02x)", mouse->type); + snprintf (mouse->name, sizeof (mouse->name), + "unknown DEC pointer device (type = 0x%02x)", + mouse->type); break; } - printk (KERN_INFO "Found %s version 0x%02x from country 0x%02x " - "on port %s\n", mouse->name, mouse->version, - mouse->country, mouse->phys); + printk (KERN_INFO + "Found %s version 0x%02x from country 0x%02x on port %s\n", + mouse->name, mouse->version, mouse->country, mouse->phys); } /* @@ -503,8 +506,9 @@ vsxxxaa_connect (struct serio *serio, struct serio_driver *drv) mouse->dev = input_dev; mouse->serio = serio; - sprintf (mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer"); - sprintf (mouse->phys, "%s/input0", serio->phys); + strlcat (mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer", + sizeof (mouse->name)); + snprintf (mouse->phys, sizeof (mouse->phys), "%s/input0", serio->phys); input_dev->name = mouse->name; input_dev->phys = mouse->phys; |