lkml.org 
[lkml]   [2006]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [RFC][PATCH 2.6.17-rc6] input/mouse/sermouse: fix memleak and potential buffer overflow
    Date
    Wouter Paesen wrote:
    >On Sun, Jun 18, 2006 at 12:24:31AM -0400, Dmitry Torokhov wrote:
    >> > Because serio->phys is also a 32 character field the sprintf could
    >> > result in 39 characters being written to the sermouse->phys.
    >>
    >> Right, we need to change it to use snprintf.
    >
    >Thanks, this patch will do just that.
    >Still, keeping the array 39 characters long will prevent truncation of the
    > string.
    >
    >Signed-off-by: Wouter Paesen <wouter@kangaroot.net>
    >
    >--- linux-2.6.17-rc6.orig/drivers/input/mouse/sermouse.c 2006-06-20
    > 08:31:12.000000000 +0200 +++
    > linux-2.6.17-rc6/drivers/input/mouse/sermouse.c 2006-06-20
    > 08:31:41.000000000 +0200 @@ -53,7 +53,7 @@ struct sermouse {
    > unsigned char count;
    > unsigned char type;
    > unsigned long last;
    >- char phys[32];
    >+ char phys[39];
    > };
    >
    > /*
    >@@ -254,7 +254,7 @@ static int sermouse_connect(struct serio
    > goto fail;
    >
    > sermouse->dev = input_dev;
    >- sprintf(sermouse->phys, "%s/input0", serio->phys);
    >+ snprintf(sermouse->phys, 39, "%s/input0", serio->phys);

    This adds a magic number here. I suggest using sizeof(sermouse->phys) instead.

    Eike
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2006-06-21 18:26    [W:0.024 / U:59.436 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site