Input: fix potential overflows in driver/input/joystick

Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

1 files changed, 13 insertions, 10 deletions

diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 3121961e3e7c..01dc0b195d59 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -408,21 +408,23 @@ static void analog_calibrate_timer(struct analog_port *port)
 
 static void analog_name(struct analog *analog)
 {
-        sprintf(analog->name, "Analog %d-axis %d-button",
-                hweight8(analog->mask & ANALOG_AXES_STD),
-                hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 +
-                hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);
+        snprintf(analog->name, sizeof(analog->name), "Analog %d-axis %d-button",
+                 hweight8(analog->mask & ANALOG_AXES_STD),
+                 hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 +
+                 hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);
 
         if (analog->mask & ANALOG_HATS_ALL)
-                sprintf(analog->name, "%s %d-hat",
-                        analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));
+                snprintf(analog->name, sizeof(analog->name), "%s %d-hat",
+                         analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));
 
         if (analog->mask & ANALOG_HAT_FCS)
-                        strcat(analog->name, " FCS");
+                strlcat(analog->name, " FCS", sizeof(analog->name));
         if (analog->mask & ANALOG_ANY_CHF)
-                        strcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF");
+                strlcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF",
+                        sizeof(analog->name));
 
-        strcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick");
+        strlcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick",
+                sizeof(analog->name));
 }
 
 /*
@@ -435,7 +437,8 @@ static int analog_init_device(struct analog_port *port, struct analog *analog, i
         int i, j, t, v, w, x, y, z;
 
         analog_name(analog);
-        sprintf(analog->phys, "%s/input%d", port->gameport->phys, index);
+        snprintf(analog->phys, sizeof(analog->phys),
+                 "%s/input%d", port->gameport->phys, index);
         analog->buttons = (analog->mask & ANALOG_GAMEPAD) ? analog_pad_btn : analog_joy_btn;
 
         analog->dev = input_dev = input_allocate_device();