diff options
author | Dmitry Torokhov <dtor_core@ameritech.net> | 2006-06-26 05:46:17 (GMT) |
---|---|---|
committer | Dmitry Torokhov <dtor_core@ameritech.net> | 2006-06-26 05:46:17 (GMT) |
commit | ea08c6faa0a8dc93b016663de55e49822ed0b33f (patch) | |
tree | a1cc8a448e87457c8f8ed45d5f9f430369eb4062 /drivers/input | |
parent | a21466cc77b25dc2afd1292c79c7fc8fd454a1a7 (diff) | |
download | linux-ea08c6faa0a8dc93b016663de55e49822ed0b33f.tar.xz |
Input: fix potential overflows in driver/input/keyboard
Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers/input')
-rw-r--r-- | drivers/input/keyboard/atkbd.c | 11 | ||||
-rw-r--r-- | drivers/input/keyboard/lkkbd.c | 9 | ||||
-rw-r--r-- | drivers/input/keyboard/newtonkbd.c | 2 | ||||
-rw-r--r-- | drivers/input/keyboard/sunkbd.c | 2 | ||||
-rw-r--r-- | drivers/input/keyboard/xtkbd.c | 2 |
5 files changed, 16 insertions, 10 deletions
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c index fad04b6..0eb955d 100644 --- a/drivers/input/keyboard/atkbd.c +++ b/drivers/input/keyboard/atkbd.c @@ -776,12 +776,15 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd) int i; if (atkbd->extra) - sprintf(atkbd->name, "AT Set 2 Extra keyboard"); + snprintf(atkbd->name, sizeof(atkbd->name), + "AT Set 2 Extra keyboard"); else - sprintf(atkbd->name, "AT %s Set %d keyboard", - atkbd->translated ? "Translated" : "Raw", atkbd->set); + snprintf(atkbd->name, sizeof(atkbd->name), + "AT %s Set %d keyboard", + atkbd->translated ? "Translated" : "Raw", atkbd->set); - sprintf(atkbd->phys, "%s/input0", atkbd->ps2dev.serio->phys); + snprintf(atkbd->phys, sizeof(atkbd->phys), + "%s/input0", atkbd->ps2dev.serio->phys); input_dev->name = atkbd->name; input_dev->phys = atkbd->phys; diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c index 77c4d96..5174224 100644 --- a/drivers/input/keyboard/lkkbd.c +++ b/drivers/input/keyboard/lkkbd.c @@ -384,18 +384,21 @@ lkkbd_detection_done (struct lkkbd *lk) */ switch (lk->id[4]) { case 1: - sprintf (lk->name, "DEC LK201 keyboard"); + strlcpy (lk->name, "DEC LK201 keyboard", + sizeof (lk->name)); if (lk201_compose_is_alt) lk->keycode[0xb1] = KEY_LEFTALT; break; case 2: - sprintf (lk->name, "DEC LK401 keyboard"); + strlcpy (lk->name, "DEC LK401 keyboard", + sizeof (lk->name)); break; default: - sprintf (lk->name, "Unknown DEC keyboard"); + strlcpy (lk->name, "Unknown DEC keyboard", + sizeof (lk->name)); printk (KERN_ERR "lkkbd: keyboard on %s is unknown, " "please report to Jan-Benedict Glaw " "<jbglaw@lug-owl.de>\n", lk->phys); diff --git a/drivers/input/keyboard/newtonkbd.c b/drivers/input/keyboard/newtonkbd.c index d10983c..40a3f551 100644 --- a/drivers/input/keyboard/newtonkbd.c +++ b/drivers/input/keyboard/newtonkbd.c @@ -96,7 +96,7 @@ static int nkbd_connect(struct serio *serio, struct serio_driver *drv) nkbd->serio = serio; nkbd->dev = input_dev; - sprintf(nkbd->phys, "%s/input0", serio->phys); + snprintf(nkbd->phys, sizeof(nkbd->phys), "%s/input0", serio->phys); memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode)); input_dev->name = "Newton Keyboard"; diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c index b15b6d8..9dbd7b8 100644 --- a/drivers/input/keyboard/sunkbd.c +++ b/drivers/input/keyboard/sunkbd.c @@ -263,7 +263,7 @@ static int sunkbd_connect(struct serio *serio, struct serio_driver *drv) goto fail; } - sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type); + snprintf(sunkbd->name, sizeof(sunkbd->name), "Sun Type %d keyboard", sunkbd->type); memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode)); input_dev->name = sunkbd->name; diff --git a/drivers/input/keyboard/xtkbd.c b/drivers/input/keyboard/xtkbd.c index 4135e3e..0821d53 100644 --- a/drivers/input/keyboard/xtkbd.c +++ b/drivers/input/keyboard/xtkbd.c @@ -100,7 +100,7 @@ static int xtkbd_connect(struct serio *serio, struct serio_driver *drv) xtkbd->serio = serio; xtkbd->dev = input_dev; - sprintf(xtkbd->phys, "%s/input0", serio->phys); + snprintf(xtkbd->phys, sizeof(xtkbd->phys), "%s/input0", serio->phys); memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode)); input_dev->name = "XT Keyboard"; |