Messages in this thread Patch in this message |  | | | Date | Tue, 20 Jun 2006 08:41:28 +0200 | | From | Wouter Paesen <> | | Subject | Re: [RFC][PATCH 2.6.17-rc6] input/mouse/sermouse: fix memleak and potential buffer overflow |
| |
On Sun, Jun 18, 2006 at 12:24:31AM -0400, Dmitry Torokhov wrote: > > Because serio->phys is also a 32 character field the sprintf could > > result in 39 characters being written to the sermouse->phys. > > Right, we need to change it to use snprintf.
Thanks, this patch will do just that. Still, keeping the array 39 characters long will prevent truncation of the string.
Signed-off-by: Wouter Paesen <wouter@kangaroot.net>
--- linux-2.6.17-rc6.orig/drivers/input/mouse/sermouse.c 2006-06-20 08:31:12.000000000 +0200 +++ linux-2.6.17-rc6/drivers/input/mouse/sermouse.c 2006-06-20 08:31:41.000000000 +0200 @@ -53,7 +53,7 @@ struct sermouse { unsigned char count; unsigned char type; unsigned long last; - char phys[32]; + char phys[39]; }; /* @@ -254,7 +254,7 @@ static int sermouse_connect(struct serio goto fail; sermouse->dev = input_dev; - sprintf(sermouse->phys, "%s/input0", serio->phys); + snprintf(sermouse->phys, 39, "%s/input0", serio->phys); sermouse->type = serio->id.proto; input_dev->name = sermouse_protocols[sermouse->type];
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |