diff options
| author | Dmitry Torokhov <dtor_core@ameritech.net> | 2006-06-26 01:45:48 -0400 |
|---|---|---|
| committer | Dmitry Torokhov <dtor_core@ameritech.net> | 2006-06-26 01:45:48 -0400 |
| commit | 10ca4c0a622a942e55dc8a6d57ebd441089c9e38 (patch) | |
| tree | dcdb84833a46e80ff95fb73b0d1f83b737f3d2b9 /drivers/input/joystick/sidewinder.c | |
| parent | 08ffce4560e0133e10634b0dd85eecee11257a1c (diff) | |
| download | op-kernel-dev-10ca4c0a622a942e55dc8a6d57ebd441089c9e38.zip op-kernel-dev-10ca4c0a622a942e55dc8a6d57ebd441089c9e38.tar.gz | |
Input: fix potential overflows in driver/input/joystick
Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Diffstat (limited to 'drivers/input/joystick/sidewinder.c')
| -rw-r--r-- | drivers/input/joystick/sidewinder.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c index 95c0de7..e58b22c 100644 --- a/drivers/input/joystick/sidewinder.c +++ b/drivers/input/joystick/sidewinder.c @@ -541,7 +541,7 @@ static void sw_print_packet(char *name, int length, unsigned char *buf, char bit * Unfortunately I don't know how to do this for the other SW types. */ -static void sw_3dp_id(unsigned char *buf, char *comment) +static void sw_3dp_id(unsigned char *buf, char *comment, size_t size) { int i; char pnp[8], rev[9]; @@ -554,7 +554,7 @@ static void sw_3dp_id(unsigned char *buf, char *comment) pnp[7] = rev[8] = 0; - sprintf(comment, " [PnP %d.%02d id %s rev %s]", + snprintf(comment, size, " [PnP %d.%02d id %s rev %s]", (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */ sw_get_bits(buf, 16, 6, 1)) / 100, (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | @@ -695,7 +695,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv) sw->type = SW_ID_FFP; sprintf(comment, " [AC %s]", sw_get_bits(idbuf,38,1,3) ? "off" : "on"); } else - sw->type = SW_ID_PP; + sw->type = SW_ID_PP; break; case 66: sw->bits = 3; @@ -703,7 +703,8 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv) sw->length = 22; case 64: sw->type = SW_ID_3DP; - if (j == 160) sw_3dp_id(idbuf, comment); + if (j == 160) + sw_3dp_id(idbuf, comment, sizeof(comment)); break; } } @@ -733,8 +734,10 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv) for (i = 0; i < sw->number; i++) { int bits, code; - sprintf(sw->name, "Microsoft SideWinder %s", sw_name[sw->type]); - sprintf(sw->phys[i], "%s/input%d", gameport->phys, i); + snprintf(sw->name, sizeof(sw->name), + "Microsoft SideWinder %s", sw_name[sw->type]); + snprintf(sw->phys[i], sizeof(sw->phys[i]), + "%s/input%d", gameport->phys, i); sw->dev[i] = input_dev = input_allocate_device(); if (!input_dev) { |
