Input: fix potential overflows in driver/input/keyboard

Change all sprintfs into snprintfs to make sure we won't stomp on
data adjacent to our buffers.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index fad04b6..0eb955d 100644 (file)
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -776,12 +776,15 @@ static void atkbd_set_device_attrs(struct atkbd *atkbd)
        int i;
 
        if (atkbd->extra)
-               sprintf(atkbd->name, "AT Set 2 Extra keyboard");
+               snprintf(atkbd->name, sizeof(atkbd->name),
+                        "AT Set 2 Extra keyboard");
        else
-               sprintf(atkbd->name, "AT %s Set %d keyboard",
-                       atkbd->translated ? "Translated" : "Raw", atkbd->set);
+               snprintf(atkbd->name, sizeof(atkbd->name),
+                        "AT %s Set %d keyboard",
+                        atkbd->translated ? "Translated" : "Raw", atkbd->set);
 
-       sprintf(atkbd->phys, "%s/input0", atkbd->ps2dev.serio->phys);
+       snprintf(atkbd->phys, sizeof(atkbd->phys),
+                "%s/input0", atkbd->ps2dev.serio->phys);
 
        input_dev->name = atkbd->name;
        input_dev->phys = atkbd->phys;

diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index 77c4d96..5174224 100644 (file)
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -384,18 +384,21 @@ lkkbd_detection_done (struct lkkbd *lk)
         */
        switch (lk->id[4]) {
                case 1:
-                       sprintf (lk->name, "DEC LK201 keyboard");
+                       strlcpy (lk->name, "DEC LK201 keyboard",
+                                sizeof (lk->name));
 
                        if (lk201_compose_is_alt)
                                lk->keycode[0xb1] = KEY_LEFTALT;
                        break;
 
                case 2:
-                       sprintf (lk->name, "DEC LK401 keyboard");
+                       strlcpy (lk->name, "DEC LK401 keyboard",
+                                sizeof (lk->name));
                        break;
 
                default:
-                       sprintf (lk->name, "Unknown DEC keyboard");
+                       strlcpy (lk->name, "Unknown DEC keyboard",
+                                sizeof (lk->name));
                        printk (KERN_ERR "lkkbd: keyboard on %s is unknown, "
                                        "please report to Jan-Benedict Glaw "
                                        "<jbglaw@lug-owl.de>\n", lk->phys);

diff --git a/drivers/input/keyboard/newtonkbd.c b/drivers/input/keyboard/newtonkbd.c
index d10983c..40a3f55 100644 (file)
--- a/drivers/input/keyboard/newtonkbd.c
+++ b/drivers/input/keyboard/newtonkbd.c
@@ -96,7 +96,7 @@ static int nkbd_connect(struct serio *serio, struct serio_driver *drv)
 
        nkbd->serio = serio;
        nkbd->dev = input_dev;
-       sprintf(nkbd->phys, "%s/input0", serio->phys);
+       snprintf(nkbd->phys, sizeof(nkbd->phys), "%s/input0", serio->phys);
        memcpy(nkbd->keycode, nkbd_keycode, sizeof(nkbd->keycode));
 
        input_dev->name = "Newton Keyboard";

diff --git a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
index b15b6d8..9dbd7b8 100644 (file)
--- a/drivers/input/keyboard/sunkbd.c
+++ b/drivers/input/keyboard/sunkbd.c
@@ -263,7 +263,7 @@ static int sunkbd_connect(struct serio *serio, struct serio_driver *drv)
                goto fail;
        }
 
-       sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type);
+       snprintf(sunkbd->name, sizeof(sunkbd->name), "Sun Type %d keyboard", sunkbd->type);
        memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));
 
        input_dev->name = sunkbd->name;

diff --git a/drivers/input/keyboard/xtkbd.c b/drivers/input/keyboard/xtkbd.c
index 4135e3e..0821d53 100644 (file)
--- a/drivers/input/keyboard/xtkbd.c
+++ b/drivers/input/keyboard/xtkbd.c
@@ -100,7 +100,7 @@ static int xtkbd_connect(struct serio *serio, struct serio_driver *drv)
 
        xtkbd->serio = serio;
        xtkbd->dev = input_dev;
-       sprintf(xtkbd->phys, "%s/input0", serio->phys);
+       snprintf(xtkbd->phys, sizeof(xtkbd->phys), "%s/input0", serio->phys);
        memcpy(xtkbd->keycode, xtkbd_keycode, sizeof(xtkbd->keycode));
 
        input_dev->name = "XT Keyboard";