aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDmitry Torokhov <dtor_core@ameritech.net>2006-06-26 01:46:17 -0400
committerDmitry Torokhov <dtor_core@ameritech.net>2006-06-26 01:46:17 -0400
commitea08c6faa0a8dc93b016663de55e49822ed0b33f (patch)
treea1cc8a448e87457c8f8ed45d5f9f430369eb4062
parenta21466cc77b25dc2afd1292c79c7fc8fd454a1a7 (diff)
Input: fix potential overflows in driver/input/keyboard
Change all sprintfs into snprintfs to make sure we won't stomp on data adjacent to our buffers. Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
-rw-r--r--drivers/input/keyboard/atkbd.c11
-rw-r--r--drivers/input/keyboard/lkkbd.c9
-rw-r--r--drivers/input/keyboard/newtonkbd.c2
-rw-r--r--drivers/input/keyboard/sunkbd.c2
-rw-r--r--drivers/input/keyboard/xtkbd.c2
5 files changed, 16 insertions, 10 deletions
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index fad04b66d268..0eb955ddc654 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -776,12 +776,15 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd)
776 int i; 776 int i;
777 777
778 if (atkbd->extra) 778 if (atkbd->extra)
779 sprintf(atkbd->name, "AT Set 2 Extra keyboard"); 779 snprintf(atkbd->name, sizeof(atkbd->name),
780 "AT Set 2 Extra keyboard");
780 else 781 else
781 sprintf(atkbd->name, "AT %s Set %d keyboard", 782 snprintf(atkbd->name, sizeof(atkbd->name),
782 atkbd->translated ? "Translated" : "Raw", atkbd->set); 783 "AT %s Set %d keyboard",
784 atkbd->translated ? "Translated" : "Raw", atkbd->set);
783 785
784 sprintf(atkbd->phys, "%s/input0", atkbd->ps2dev.serio->phys); 786 snprintf(atkbd->phys, sizeof(atkbd->phys),
787 "%s/input0", atkbd->ps2dev.serio->phys);
785 788
786 input_dev->name = atkbd->name; 789 input_dev->name = atkbd->name;
787 input_dev->phys = atkbd->phys; 790 input_dev->phys = atkbd->phys;
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index 77c4d9669ad0..5174224cadb4 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -384,18 +384,21 @@ lkkbd_detection_done (struct lkkbd *lk)
384 */ 384 */
385 switch (lk->id[4]) { 385 switch (lk->id[4]) {
386 case 1: 386 case 1:
387 sprintf (lk->name, "DEC LK201 keyboard"); 387 strlcpy (lk->name, "DEC LK201 keyboard",
388 sizeof (lk->name));
388 389
389 if (lk201_compose_is_alt) 390 if (lk201_compose_is_alt)
390 lk->keycode[0xb1] = KEY_LEFTALT; 391 lk->keycode[0xb1] = KEY_LEFTALT;
391 break; 392 break;
392 393
393 case 2: 394 case 2:
394 sprintf (lk->name, "DEC LK401 keyboard"); 395 strlcpy (lk->name, "DEC LK401 keyboard",
396 sizeof (lk->name));
395 break; 397 break;
396 398
397 default: 399 default:
398 sprintf (lk->name, "Unknown DEC keyboard"); 400 strlcpy (lk->name, "Unknown DEC keyboard",
401 sizeof (lk->name));
399 printk (KERN_ERR "lkkbd: keyboard on %s is unknown, " 402 printk (KERN_ERR "lkkbd: keyboard on %s is unknown, "
400 "please report to Jan-Benedict Glaw " 403 "please report to Jan-Benedict Glaw "
401 "<jbglaw@lug-owl.de>\n", lk->phys); 404 "<jbglaw@lug-owl.de>\n", lk->phys);
diff --git a/drivers/input/keyboard/newtonkbd.c b/drivers/input/keyboard/newtonkbd.c
index d10983c521e6..40a3f551247e 100644
--- a/drivers/input/keyboard/newtonkbd.c
+++ b/drivers/input/keyboard/newtonkbd.c
@@ -96,7 +96,7 @@ static int nkbd_connect(struct serio *serio, struct serio_driver *drv)
96 96
97 nkbd->serio = serio; 97 nkbd->serio = serio;
98 nkbd->dev = input_dev; 98 nkbd->dev = input_dev;
99 sprintf(nkbd->phys, "%s/input0", serio->phys); 99 snprintf(nkbd->phys, sizeof(nkbd->phys), "%s/input0", serio->phys);
100 memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode)); 100 memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode));
101 101
102 input_dev->name = "Newton Keyboard"; 102 input_dev->name = "Newton Keyboard";
diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
index b15b6d8d4f83..9dbd7b85686d 100644
--- a/drivers/input/keyboard/sunkbd.c
+++ b/drivers/input/keyboard/sunkbd.c
@@ -263,7 +263,7 @@ static int sunkbd_connect(struct serio *serio, struct serio_driver *drv)
263 goto fail; 263 goto fail;
264 } 264 }
265 265
266 sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type); 266 snprintf(sunkbd->name, sizeof(sunkbd->name), "Sun Type %d keyboard", sunkbd->type);
267 memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode)); 267 memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));
268 268
269 input_dev->name = sunkbd->name; 269 input_dev->name = sunkbd->name;
diff --git a/drivers/input/keyboard/xtkbd.c b/drivers/input/keyboard/xtkbd.c
index 4135e3e16c51..0821d53cf0c1 100644
--- a/drivers/input/keyboard/xtkbd.c
+++ b/drivers/input/keyboard/xtkbd.c
@@ -100,7 +100,7 @@ static int xtkbd_connect(struct serio *serio, struct serio_driver *drv)
100 100
101 xtkbd->serio = serio; 101 xtkbd->serio = serio;
102 xtkbd->dev = input_dev; 102 xtkbd->dev = input_dev;
103 sprintf(xtkbd->phys, "%s/input0", serio->phys); 103 snprintf(xtkbd->phys, sizeof(xtkbd->phys), "%s/input0", serio->phys);
104 memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode)); 104 memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode));
105 105
106 input_dev->name = "XT Keyboard"; 106 input_dev->name = "XT Keyboard";