Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 10ca4c0a622a942e55dc8a6d57ebd441089c9e38

Authored by Dmitry Torokhov
1 parent 08ffce4560
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

Input: fix potential overflows in driver/input/joystick 

Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Showing 16 changed files with 40 additions and 30 deletions Side-by-side Diff

drivers/input/joystick/a3d.c
Diff comments   View file @ 10ca4c0
... ... @@ -306,7 +306,7 @@
306 306 gameport_set_poll_handler(gameport, a3d_poll);
307 307 gameport_set_poll_interval(gameport, 20);
308 308  
309   - sprintf(a3d->phys, "%s/input0", gameport->phys);
  309 + snprintf(a3d->phys, sizeof(a3d->phys), "%s/input0", gameport->phys);
310 310  
311 311 input_dev->name = a3d_names[a3d->mode];
312 312 input_dev->phys = a3d->phys;
drivers/input/joystick/analog.c
Diff comments   View file @ 10ca4c0
... ... @@ -408,21 +408,23 @@
408 408  
409 409 static void analog_name(struct analog *analog)
410 410 {
411   - sprintf(analog->name, "Analog %d-axis %d-button",
412   - hweight8(analog->mask & ANALOG_AXES_STD),
413   - hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 +
414   - hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);
  411 + snprintf(analog->name, sizeof(analog->name), "Analog %d-axis %d-button",
  412 + hweight8(analog->mask & ANALOG_AXES_STD),
  413 + hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 +
  414 + hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);
415 415  
416 416 if (analog->mask & ANALOG_HATS_ALL)
417   - sprintf(analog->name, "%s %d-hat",
418   - analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));
  417 + snprintf(analog->name, sizeof(analog->name), "%s %d-hat",
  418 + analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));
419 419  
420 420 if (analog->mask & ANALOG_HAT_FCS)
421   - strcat(analog->name, " FCS");
  421 + strlcat(analog->name, " FCS", sizeof(analog->name));
422 422 if (analog->mask & ANALOG_ANY_CHF)
423   - strcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF");
  423 + strlcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF",
  424 + sizeof(analog->name));
424 425  
425   - strcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick");
  426 + strlcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick",
  427 + sizeof(analog->name));
426 428 }
427 429  
428 430 /*
... ... @@ -435,7 +437,8 @@
435 437 int i, j, t, v, w, x, y, z;
436 438  
437 439 analog_name(analog);
438   - sprintf(analog->phys, "%s/input%d", port->gameport->phys, index);
  440 + snprintf(analog->phys, sizeof(analog->phys),
  441 + "%s/input%d", port->gameport->phys, index);
439 442 analog->buttons = (analog->mask & ANALOG_GAMEPAD) ? analog_pad_btn : analog_joy_btn;
440 443  
441 444 analog->dev = input_dev = input_allocate_device();
drivers/input/joystick/cobra.c
Diff comments   View file @ 10ca4c0
... ... @@ -202,7 +202,8 @@
202 202 goto fail3;
203 203 }
204 204  
205   - sprintf(cobra->phys[i], "%s/input%d", gameport->phys, i);
  205 + snprintf(cobra->phys[i], sizeof(cobra->phys[i]),
  206 + "%s/input%d", gameport->phys, i);
206 207  
207 208 input_dev->name = "Creative Labs Blaster GamePad Cobra";
208 209 input_dev->phys = cobra->phys[i];
drivers/input/joystick/db9.c
Diff comments   View file @ 10ca4c0
... ... @@ -620,7 +620,8 @@
620 620 goto err_unreg_devs;
621 621 }
622 622  
623   - sprintf(db9->phys[i], "%s/input%d", db9->pd->port->name, i);
  623 + snprintf(db9->phys[i], sizeof(db9->phys[i]),
  624 + "%s/input%d", db9->pd->port->name, i);
624 625  
625 626 input_dev->name = db9_mode->name;
626 627 input_dev->phys = db9->phys[i];
drivers/input/joystick/gamecon.c
Diff comments   View file @ 10ca4c0
... ... @@ -761,7 +761,8 @@
761 761 if (!pads[i])
762 762 continue;
763 763  
764   - sprintf(gc->phys[i], "%s/input%d", gc->pd->port->name, i);
  764 + snprintf(gc->phys[i], sizeof(gc->phys[i]),
  765 + "%s/input%d", gc->pd->port->name, i);
765 766 err = gc_setup_pad(gc, i, pads[i]);
766 767 if (err)
767 768 goto err_unreg_devs;
drivers/input/joystick/gf2k.c
Diff comments   View file @ 10ca4c0
... ... @@ -298,7 +298,7 @@
298 298 gameport_set_poll_handler(gameport, gf2k_poll);
299 299 gameport_set_poll_interval(gameport, 20);
300 300  
301   - sprintf(gf2k->phys, "%s/input0", gameport->phys);
  301 + snprintf(gf2k->phys, sizeof(gf2k->phys), "%s/input0", gameport->phys);
302 302  
303 303 gf2k->length = gf2k_lens[gf2k->id];
304 304  
drivers/input/joystick/grip.c
Diff comments   View file @ 10ca4c0
... ... @@ -354,7 +354,8 @@
354 354 goto fail3;
355 355 }
356 356  
357   - sprintf(grip->phys[i], "%s/input%d", gameport->phys, i);
  357 + snprintf(grip->phys[i], sizeof(grip->phys[i]),
  358 + "%s/input%d", gameport->phys, i);
358 359  
359 360 input_dev->name = grip_name[grip->mode[i]];
360 361 input_dev->phys = grip->phys[i];
drivers/input/joystick/guillemot.c
Diff comments   View file @ 10ca4c0
... ... @@ -222,7 +222,7 @@
222 222 gameport_set_poll_handler(gameport, guillemot_poll);
223 223 gameport_set_poll_interval(gameport, 20);
224 224  
225   - sprintf(guillemot->phys, "%s/input0", gameport->phys);
  225 + snprintf(guillemot->phys, sizeof(guillemot->phys), "%s/input0", gameport->phys);
226 226 guillemot->type = guillemot_type + i;
227 227  
228 228 input_dev->name = guillemot_type[i].name;
drivers/input/joystick/interact.c
Diff comments   View file @ 10ca4c0
... ... @@ -251,7 +251,7 @@
251 251 gameport_set_poll_handler(gameport, interact_poll);
252 252 gameport_set_poll_interval(gameport, 20);
253 253  
254   - sprintf(interact->phys, "%s/input0", gameport->phys);
  254 + snprintf(interact->phys, sizeof(interact->phys), "%s/input0", gameport->phys);
255 255  
256 256 interact->type = i;
257 257 interact->length = interact_type[i].length;
drivers/input/joystick/magellan.c
Diff comments   View file @ 10ca4c0
... ... @@ -162,7 +162,7 @@
162 162 goto fail;
163 163  
164 164 magellan->dev = input_dev;
165   - sprintf(magellan->phys, "%s/input0", serio->phys);
  165 + snprintf(magellan->phys, sizeof(magellan->phys), "%s/input0", serio->phys);
166 166  
167 167 input_dev->name = "LogiCad3D Magellan / SpaceMouse";
168 168 input_dev->phys = magellan->phys;
drivers/input/joystick/sidewinder.c
Diff comments   View file @ 10ca4c0
... ... @@ -541,7 +541,7 @@
541 541 * Unfortunately I don't know how to do this for the other SW types.
542 542 */
543 543  
544   -static void sw_3dp_id(unsigned char *buf, char *comment)
  544 +static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
545 545 {
546 546 int i;
547 547 char pnp[8], rev[9];
... ... @@ -554,7 +554,7 @@
554 554  
555 555 pnp[7] = rev[8] = 0;
556 556  
557   - sprintf(comment, " [PnP %d.%02d id %s rev %s]",
  557 + snprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
558 558 (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */
559 559 sw_get_bits(buf, 16, 6, 1)) / 100,
560 560 (int) ((sw_get_bits(buf, 8, 6, 1) << 6) |
... ... @@ -695,7 +695,7 @@
695 695 sw->type = SW_ID_FFP;
696 696 sprintf(comment, " [AC %s]", sw_get_bits(idbuf,38,1,3) ? "off" : "on");
697 697 } else
698   - sw->type = SW_ID_PP;
  698 + sw->type = SW_ID_PP;
699 699 break;
700 700 case 66:
701 701 sw->bits = 3;
... ... @@ -703,7 +703,8 @@
703 703 sw->length = 22;
704 704 case 64:
705 705 sw->type = SW_ID_3DP;
706   - if (j == 160) sw_3dp_id(idbuf, comment);
  706 + if (j == 160)
  707 + sw_3dp_id(idbuf, comment, sizeof(comment));
707 708 break;
708 709 }
709 710 }
... ... @@ -733,8 +734,10 @@
733 734 for (i = 0; i < sw->number; i++) {
734 735 int bits, code;
735 736  
736   - sprintf(sw->name, "Microsoft SideWinder %s", sw_name[sw->type]);
737   - sprintf(sw->phys[i], "%s/input%d", gameport->phys, i);
  737 + snprintf(sw->name, sizeof(sw->name),
  738 + "Microsoft SideWinder %s", sw_name[sw->type]);
  739 + snprintf(sw->phys[i], sizeof(sw->phys[i]),
  740 + "%s/input%d", gameport->phys, i);
738 741  
739 742 sw->dev[i] = input_dev = input_allocate_device();
740 743 if (!input_dev) {
drivers/input/joystick/spaceball.c
Diff comments   View file @ 10ca4c0
... ... @@ -220,7 +220,7 @@
220 220 goto fail;
221 221  
222 222 spaceball->dev = input_dev;
223   - sprintf(spaceball->phys, "%s/input0", serio->phys);
  223 + snprintf(spaceball->phys, sizeof(spaceball->phys), "%s/input0", serio->phys);
224 224  
225 225 input_dev->name = spaceball_names[id];
226 226 input_dev->phys = spaceball->phys;
drivers/input/joystick/spaceorb.c
Diff comments   View file @ 10ca4c0
... ... @@ -177,7 +177,7 @@
177 177 goto fail;
178 178  
179 179 spaceorb->dev = input_dev;
180   - sprintf(spaceorb->phys, "%s/input0", serio->phys);
  180 + snprintf(spaceorb->phys, sizeof(spaceorb->phys), "%s/input0", serio->phys);
181 181  
182 182 input_dev->name = "SpaceTec SpaceOrb 360 / Avenger";
183 183 input_dev->phys = spaceorb->phys;
drivers/input/joystick/stinger.c
Diff comments   View file @ 10ca4c0
... ... @@ -148,7 +148,7 @@
148 148 goto fail;
149 149  
150 150 stinger->dev = input_dev;
151   - sprintf(stinger->phys, "%s/serio0", serio->phys);
  151 + snprintf(stinger->phys, sizeof(stinger->phys), "%s/serio0", serio->phys);
152 152  
153 153 input_dev->name = "Gravis Stinger";
154 154 input_dev->phys = stinger->phys;
drivers/input/joystick/twidjoy.c
Diff comments   View file @ 10ca4c0
... ... @@ -199,7 +199,7 @@
199 199 goto fail;
200 200  
201 201 twidjoy->dev = input_dev;
202   - sprintf(twidjoy->phys, "%s/input0", serio->phys);
  202 + snprintf(twidjoy->phys, sizeof(twidjoy->phys), "%s/input0", serio->phys);
203 203  
204 204 input_dev->name = "Handykey Twiddler";
205 205 input_dev->phys = twidjoy->phys;
drivers/input/joystick/warrior.c
Diff comments   View file @ 10ca4c0
... ... @@ -154,7 +154,7 @@
154 154 goto fail;
155 155  
156 156 warrior->dev = input_dev;
157   - sprintf(warrior->phys, "%s/input0", serio->phys);
  157 + snprintf(warrior->phys, sizeof(warrior->phys), "%s/input0", serio->phys);
158 158  
159 159 input_dev->name = "Logitech WingMan Warrior";
160 160 input_dev->phys = warrior->phys;