diff options
| author | Kenichi Nagai <kenichi3.nagai@toshiba.co.jp> | 2007-05-11 01:12:15 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-05-11 12:08:04 -0400 |
| commit | bf61f8d357e5d71d74a3ca3be3cce52bf1a2c01a (patch) | |
| tree | c27279afbee1b9927f992938587db09f061398f5 /drivers/input/evdev.c | |
| parent | 435b71be20f2ad3688acd94c05e968e029464d60 (diff) | |
Input: evdev - fix overflow in compat_ioctl
When exporting input device bitmaps via compat_ioctl on BIG_ENDIAN
platforms evdev calculates data size incorrectly. This causes buffer
overflow if user specifies buffer smaller than maxlen.
Signed-off-by: Kenichi Nagai <kenichi3.nagai@toshiba.co.jp>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/input/evdev.c')
| -rw-r--r-- | drivers/input/evdev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c index 55a72592704c..b234729706be 100644 --- a/drivers/input/evdev.c +++ b/drivers/input/evdev.c | |||
| @@ -336,7 +336,7 @@ static int bits_to_user(unsigned long *bits, unsigned int maxbit, | |||
| 336 | 336 | ||
| 337 | if (compat) { | 337 | if (compat) { |
| 338 | len = NBITS_COMPAT(maxbit) * sizeof(compat_long_t); | 338 | len = NBITS_COMPAT(maxbit) * sizeof(compat_long_t); |
| 339 | if (len < maxlen) | 339 | if (len > maxlen) |
| 340 | len = maxlen; | 340 | len = maxlen; |
| 341 | 341 | ||
| 342 | for (i = 0; i < len / sizeof(compat_long_t); i++) | 342 | for (i = 0; i < len / sizeof(compat_long_t); i++) |