aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/input/evdev.c
diff options
context:
space:
mode:
authorKenichi Nagai <kenichi3.nagai@toshiba.co.jp>2007-05-11 01:12:15 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-05-11 12:08:04 -0400
commitbf61f8d357e5d71d74a3ca3be3cce52bf1a2c01a (patch)
treec27279afbee1b9927f992938587db09f061398f5 /drivers/input/evdev.c
parent435b71be20f2ad3688acd94c05e968e029464d60 (diff)
Input: evdev - fix overflow in compat_ioctl
When exporting input device bitmaps via compat_ioctl on BIG_ENDIAN platforms evdev calculates data size incorrectly. This causes buffer overflow if user specifies buffer smaller than maxlen. Signed-off-by: Kenichi Nagai <kenichi3.nagai@toshiba.co.jp> Signed-off-by: Dmitry Torokhov <dtor@mail.ru> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/input/evdev.c')
-rw-r--r--drivers/input/evdev.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 55a72592704c..b234729706be 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -336,7 +336,7 @@ static int bits_to_user(unsigned long *bits, unsigned int maxbit,
336 336
337 if (compat) { 337 if (compat) {
338 len = NBITS_COMPAT(maxbit) * sizeof(compat_long_t); 338 len = NBITS_COMPAT(maxbit) * sizeof(compat_long_t);
339 if (len < maxlen) 339 if (len > maxlen)
340 len = maxlen; 340 len = maxlen;
341 341
342 for (i = 0; i < len / sizeof(compat_long_t); i++) 342 for (i = 0; i < len / sizeof(compat_long_t); i++)