tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Input: fix potential overflows in driver/input/joystick

Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Dmitry Torokhov 10ca4c0a 08ffce45

+40 -30
+1 -1
drivers/input/joystick/a3d.c
··· 306 306 gameport_set_poll_handler(gameport, a3d_poll); 307 307 gameport_set_poll_interval(gameport, 20); 308 308 309 - sprintf(a3d->phys, "%s/input0", gameport->phys); 309 + snprintf(a3d->phys, sizeof(a3d->phys), "%s/input0", gameport->phys); 310 310 311 311 input_dev->name = a3d_names[a3d->mode]; 312 312 input_dev->phys = a3d->phys;
+13 -10
drivers/input/joystick/analog.c
··· 408 408 409 409 static void analog_name(struct analog *analog) 410 410 { 411 - sprintf(analog->name, "Analog %d-axis %d-button", 412 - hweight8(analog->mask & ANALOG_AXES_STD), 413 - hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 + 414 - hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4); 411 + snprintf(analog->name, sizeof(analog->name), "Analog %d-axis %d-button", 412 + hweight8(analog->mask & ANALOG_AXES_STD), 413 + hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 + 414 + hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4); 415 415 416 416 if (analog->mask & ANALOG_HATS_ALL) 417 - sprintf(analog->name, "%s %d-hat", 418 - analog->name, hweight16(analog->mask & ANALOG_HATS_ALL)); 417 + snprintf(analog->name, sizeof(analog->name), "%s %d-hat", 418 + analog->name, hweight16(analog->mask & ANALOG_HATS_ALL)); 419 419 420 420 if (analog->mask & ANALOG_HAT_FCS) 421 - strcat(analog->name, " FCS"); 421 + strlcat(analog->name, " FCS", sizeof(analog->name)); 422 422 if (analog->mask & ANALOG_ANY_CHF) 423 - strcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF"); 423 + strlcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF", 424 + sizeof(analog->name)); 424 425 425 - strcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick"); 426 + strlcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick", 427 + sizeof(analog->name)); 426 428 } 427 429 428 430 /* ··· 437 435 int i, j, t, v, w, x, y, z; 438 436 439 437 analog_name(analog); 440 - sprintf(analog->phys, "%s/input%d", port->gameport->phys, index); 438 + snprintf(analog->phys, sizeof(analog->phys), 439 + "%s/input%d", port->gameport->phys, index); 441 440 analog->buttons = (analog->mask & ANALOG_GAMEPAD) ? analog_pad_btn : analog_joy_btn; 442 441 443 442 analog->dev = input_dev = input_allocate_device();
+2 -1
drivers/input/joystick/cobra.c
··· 202 202 goto fail3; 203 203 } 204 204 205 - sprintf(cobra->phys[i], "%s/input%d", gameport->phys, i); 205 + snprintf(cobra->phys[i], sizeof(cobra->phys[i]), 206 + "%s/input%d", gameport->phys, i); 206 207 207 208 input_dev->name = "Creative Labs Blaster GamePad Cobra"; 208 209 input_dev->phys = cobra->phys[i];
+2 -1
drivers/input/joystick/db9.c
··· 620 620 goto err_unreg_devs; 621 621 } 622 622 623 - sprintf(db9->phys[i], "%s/input%d", db9->pd->port->name, i); 623 + snprintf(db9->phys[i], sizeof(db9->phys[i]), 624 + "%s/input%d", db9->pd->port->name, i); 624 625 625 626 input_dev->name = db9_mode->name; 626 627 input_dev->phys = db9->phys[i];
+2 -1
drivers/input/joystick/gamecon.c
··· 761 761 if (!pads[i]) 762 762 continue; 763 763 764 - sprintf(gc->phys[i], "%s/input%d", gc->pd->port->name, i); 764 + snprintf(gc->phys[i], sizeof(gc->phys[i]), 765 + "%s/input%d", gc->pd->port->name, i); 765 766 err = gc_setup_pad(gc, i, pads[i]); 766 767 if (err) 767 768 goto err_unreg_devs;
+1 -1
drivers/input/joystick/gf2k.c
··· 298 298 gameport_set_poll_handler(gameport, gf2k_poll); 299 299 gameport_set_poll_interval(gameport, 20); 300 300 301 - sprintf(gf2k->phys, "%s/input0", gameport->phys); 301 + snprintf(gf2k->phys, sizeof(gf2k->phys), "%s/input0", gameport->phys); 302 302 303 303 gf2k->length = gf2k_lens[gf2k->id]; 304 304
+2 -1
drivers/input/joystick/grip.c
··· 354 354 goto fail3; 355 355 } 356 356 357 - sprintf(grip->phys[i], "%s/input%d", gameport->phys, i); 357 + snprintf(grip->phys[i], sizeof(grip->phys[i]), 358 + "%s/input%d", gameport->phys, i); 358 359 359 360 input_dev->name = grip_name[grip->mode[i]]; 360 361 input_dev->phys = grip->phys[i];
+1 -1
drivers/input/joystick/guillemot.c
··· 222 222 gameport_set_poll_handler(gameport, guillemot_poll); 223 223 gameport_set_poll_interval(gameport, 20); 224 224 225 - sprintf(guillemot->phys, "%s/input0", gameport->phys); 225 + snprintf(guillemot->phys, sizeof(guillemot->phys), "%s/input0", gameport->phys); 226 226 guillemot->type = guillemot_type + i; 227 227 228 228 input_dev->name = guillemot_type[i].name;
+1 -1
drivers/input/joystick/interact.c
··· 251 251 gameport_set_poll_handler(gameport, interact_poll); 252 252 gameport_set_poll_interval(gameport, 20); 253 253 254 - sprintf(interact->phys, "%s/input0", gameport->phys); 254 + snprintf(interact->phys, sizeof(interact->phys), "%s/input0", gameport->phys); 255 255 256 256 interact->type = i; 257 257 interact->length = interact_type[i].length;
+1 -1
drivers/input/joystick/magellan.c
··· 162 162 goto fail; 163 163 164 164 magellan->dev = input_dev; 165 - sprintf(magellan->phys, "%s/input0", serio->phys); 165 + snprintf(magellan->phys, sizeof(magellan->phys), "%s/input0", serio->phys); 166 166 167 167 input_dev->name = "LogiCad3D Magellan / SpaceMouse"; 168 168 input_dev->phys = magellan->phys;
+9 -6
drivers/input/joystick/sidewinder.c
··· 541 541 * Unfortunately I don't know how to do this for the other SW types. 542 542 */ 543 543 544 - static void sw_3dp_id(unsigned char *buf, char *comment) 544 + static void sw_3dp_id(unsigned char *buf, char *comment, size_t size) 545 545 { 546 546 int i; 547 547 char pnp[8], rev[9]; ··· 554 554 555 555 pnp[7] = rev[8] = 0; 556 556 557 - sprintf(comment, " [PnP %d.%02d id %s rev %s]", 557 + snprintf(comment, size, " [PnP %d.%02d id %s rev %s]", 558 558 (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */ 559 559 sw_get_bits(buf, 16, 6, 1)) / 100, 560 560 (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | ··· 695 695 sw->type = SW_ID_FFP; 696 696 sprintf(comment, " [AC %s]", sw_get_bits(idbuf,38,1,3) ? "off" : "on"); 697 697 } else 698 - sw->type = SW_ID_PP; 698 + sw->type = SW_ID_PP; 699 699 break; 700 700 case 66: 701 701 sw->bits = 3; ··· 703 703 sw->length = 22; 704 704 case 64: 705 705 sw->type = SW_ID_3DP; 706 - if (j == 160) sw_3dp_id(idbuf, comment); 706 + if (j == 160) 707 + sw_3dp_id(idbuf, comment, sizeof(comment)); 707 708 break; 708 709 } 709 710 } ··· 734 733 for (i = 0; i < sw->number; i++) { 735 734 int bits, code; 736 735 737 - sprintf(sw->name, "Microsoft SideWinder %s", sw_name[sw->type]); 738 - sprintf(sw->phys[i], "%s/input%d", gameport->phys, i); 736 + snprintf(sw->name, sizeof(sw->name), 737 + "Microsoft SideWinder %s", sw_name[sw->type]); 738 + snprintf(sw->phys[i], sizeof(sw->phys[i]), 739 + "%s/input%d", gameport->phys, i); 739 740 740 741 sw->dev[i] = input_dev = input_allocate_device(); 741 742 if (!input_dev) {
+1 -1
drivers/input/joystick/spaceball.c
··· 220 220 goto fail; 221 221 222 222 spaceball->dev = input_dev; 223 - sprintf(spaceball->phys, "%s/input0", serio->phys); 223 + snprintf(spaceball->phys, sizeof(spaceball->phys), "%s/input0", serio->phys); 224 224 225 225 input_dev->name = spaceball_names[id]; 226 226 input_dev->phys = spaceball->phys;
+1 -1
drivers/input/joystick/spaceorb.c
··· 177 177 goto fail; 178 178 179 179 spaceorb->dev = input_dev; 180 - sprintf(spaceorb->phys, "%s/input0", serio->phys); 180 + snprintf(spaceorb->phys, sizeof(spaceorb->phys), "%s/input0", serio->phys); 181 181 182 182 input_dev->name = "SpaceTec SpaceOrb 360 / Avenger"; 183 183 input_dev->phys = spaceorb->phys;
+1 -1
drivers/input/joystick/stinger.c
··· 148 148 goto fail; 149 149 150 150 stinger->dev = input_dev; 151 - sprintf(stinger->phys, "%s/serio0", serio->phys); 151 + snprintf(stinger->phys, sizeof(stinger->phys), "%s/serio0", serio->phys); 152 152 153 153 input_dev->name = "Gravis Stinger"; 154 154 input_dev->phys = stinger->phys;
+1 -1
drivers/input/joystick/twidjoy.c
··· 199 199 goto fail; 200 200 201 201 twidjoy->dev = input_dev; 202 - sprintf(twidjoy->phys, "%s/input0", serio->phys); 202 + snprintf(twidjoy->phys, sizeof(twidjoy->phys), "%s/input0", serio->phys); 203 203 204 204 input_dev->name = "Handykey Twiddler"; 205 205 input_dev->phys = twidjoy->phys;
+1 -1
drivers/input/joystick/warrior.c
··· 154 154 goto fail; 155 155 156 156 warrior->dev = input_dev; 157 - sprintf(warrior->phys, "%s/input0", serio->phys); 157 + snprintf(warrior->phys, sizeof(warrior->phys), "%s/input0", serio->phys); 158 158 159 159 input_dev->name = "Logitech WingMan Warrior"; 160 160 input_dev->phys = warrior->phys;