Messages in this thread Patch in this message | | | Subject | [PATCH 27/47] Fix array overflows in keyboard.c when KEY_MAX > keycode > NR_KEYS > 128 | Date | Thu, 29 Jul 2004 16:09:55 +0200 | From | Vojtech Pavlik <> |
| |
You can pull this changeset from: bk://kernel.bkbits.net/vojtech/input
===================================================================
ChangeSet@1.1722.148.14, 2004-06-23 08:06:20+02:00, vojtech@suse.cz input: Fix array overflows in keyboard.c when KEY_MAX > keycode > NR_KEYS > 128. Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
keyboard.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-)
===================================================================
diff -Nru a/drivers/char/keyboard.c b/drivers/char/keyboard.c --- a/drivers/char/keyboard.c Thu Jul 29 14:40:08 2004 +++ b/drivers/char/keyboard.c Thu Jul 29 14:40:08 2004 @@ -124,7 +124,7 @@ */ static struct input_handler kbd_handler; -static unsigned long key_down[256/BITS_PER_LONG]; /* keyboard key bitmap */ +static unsigned long key_down[NBITS(KEY_MAX)]; /* keyboard key bitmap */ static unsigned char shift_down[NR_SHIFT]; /* shift state counters.. */ static int dead_key_next; static int npadch = -1; /* -1 or number assembled on pad */ @@ -143,7 +143,7 @@ /* Simple translation table for the SysRq keys */ #ifdef CONFIG_MAGIC_SYSRQ -unsigned char kbd_sysrq_xlate[128] = +unsigned char kbd_sysrq_xlate[KEY_MAX] = "\000\0331234567890-=\177\t" /* 0x00 - 0x0f */ "qwertyuiop[]\r\000as" /* 0x10 - 0x1f */ "dfghjkl;'`\000\\zxcv" /* 0x20 - 0x2f */ @@ -1132,6 +1132,9 @@ kbd->slockstate = 0; return; } + + if (keycode > NR_KEYS) + return; keysym = key_map[keycode]; type = KTYP(keysym); - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |