Commit 10ca4c0a authored by Dmitry Torokhov's avatar Dmitry Torokhov
Browse files

Input: fix potential overflows in driver/input/joystick 



Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: default avatarDmitry Torokhov <dtor@mail.ru>
parent 08ffce45

drivers/input/joystick/a3d.c

+1 −1
Original line number Diff line number Diff line
@@ -306,7 +306,7 @@ static int a3d_connect(struct gameport *gameport, struct gameport_driver *drv) 
	gameport_set_poll_handler(gameport, a3d_poll);

	gameport_set_poll_interval(gameport, 20);



	sprintf(a3d->phys, "%s/input0", gameport->phys);

	snprintf(a3d->phys, sizeof(a3d->phys), "%s/input0", gameport->phys);



	input_dev->name = a3d_names[a3d->mode];

	input_dev->phys = a3d->phys;

drivers/input/joystick/analog.c

+13 −10
Original line number Diff line number Diff line
@@ -408,21 +408,23 @@ static void analog_calibrate_timer(struct analog_port *port) 


static void analog_name(struct analog *analog)

{

	sprintf(analog->name, "Analog %d-axis %d-button",

	snprintf(analog->name, sizeof(analog->name), "Analog %d-axis %d-button",

		 hweight8(analog->mask & ANALOG_AXES_STD),

		 hweight8(analog->mask & ANALOG_BTNS_STD) + !!(analog->mask & ANALOG_BTNS_CHF) * 2 +

		 hweight16(analog->mask & ANALOG_BTNS_GAMEPAD) + !!(analog->mask & ANALOG_HBTN_CHF) * 4);



	if (analog->mask & ANALOG_HATS_ALL)

		sprintf(analog->name, "%s %d-hat",

		snprintf(analog->name, sizeof(analog->name), "%s %d-hat",

			 analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));



	if (analog->mask & ANALOG_HAT_FCS)

			strcat(analog->name, " FCS");

		strlcat(analog->name, " FCS", sizeof(analog->name));

	if (analog->mask & ANALOG_ANY_CHF)

			strcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF");

		strlcat(analog->name, (analog->mask & ANALOG_SAITEK) ? " Saitek" : " CHF",

			sizeof(analog->name));



	strcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick");

	strlcat(analog->name, (analog->mask & ANALOG_GAMEPAD) ? " gamepad": " joystick",

		sizeof(analog->name));

}



/*
@@ -435,7 +437,8 @@ static int analog_init_device(struct analog_port *port, struct analog *analog, i 
	int i, j, t, v, w, x, y, z;



	analog_name(analog);

	sprintf(analog->phys, "%s/input%d", port->gameport->phys, index);

	snprintf(analog->phys, sizeof(analog->phys),

		 "%s/input%d", port->gameport->phys, index);

	analog->buttons = (analog->mask & ANALOG_GAMEPAD) ? analog_pad_btn : analog_joy_btn;



	analog->dev = input_dev = input_allocate_device();

drivers/input/joystick/cobra.c

+2 −1
Original line number Diff line number Diff line
@@ -202,7 +202,8 @@ static int cobra_connect(struct gameport *gameport, struct gameport_driver *drv) 
			goto fail3;

		}



		sprintf(cobra->phys[i], "%s/input%d", gameport->phys, i);

		snprintf(cobra->phys[i], sizeof(cobra->phys[i]),

			 "%s/input%d", gameport->phys, i);



		input_dev->name = "Creative Labs Blaster GamePad Cobra";

		input_dev->phys = cobra->phys[i];

drivers/input/joystick/db9.c

+2 −1
Original line number Diff line number Diff line
@@ -620,7 +620,8 @@ static struct db9 __init *db9_probe(int parport, int mode) 
			goto err_unreg_devs;

		}



		sprintf(db9->phys[i], "%s/input%d", db9->pd->port->name, i);

		snprintf(db9->phys[i], sizeof(db9->phys[i]),

			 "%s/input%d", db9->pd->port->name, i);



		input_dev->name = db9_mode->name;

		input_dev->phys = db9->phys[i];

drivers/input/joystick/gamecon.c

+2 −1
Original line number Diff line number Diff line
@@ -761,7 +761,8 @@ static struct gc __init *gc_probe(int parport, int *pads, int n_pads) 
		if (!pads[i])

			continue;



		sprintf(gc->phys[i], "%s/input%d", gc->pd->port->name, i);

		snprintf(gc->phys[i], sizeof(gc->phys[i]),

			 "%s/input%d", gc->pd->port->name, i);

		err = gc_setup_pad(gc, i, pads[i]);

		if (err)

			goto err_unreg_devs;