Re: [RFC][PATCH 2.6.17-rc6] input/mouse/sermouse: fix memleak and potential buffer overflow

[Wouter Paesen]

On Sun, Jun 18, 2006 at 12:24:31AM -0400, Dmitry Torokhov wrote:
> >   Because serio->phys is also a 32 character field the sprintf could
> >   result in 39 characters being written to the sermouse->phys.
> 
> Right, we need to change it to use snprintf.

Thanks, this patch will do just that. 
Still, keeping the array 39 characters long will prevent truncation of the string.

Signed-off-by: Wouter Paesen <wouter@xxxxxxxxxxxxx>

--- linux-2.6.17-rc6.orig/drivers/input/mouse/sermouse.c 2006-06-20 08:31:12.000000000 +0200
+++ linux-2.6.17-rc6/drivers/input/mouse/sermouse.c 2006-06-20 08:31:41.000000000 +0200
@@ -53,7 +53,7 @@ struct sermouse {
 	unsigned char count;
 	unsigned char type;
 	unsigned long last;
-	char phys[32];
+	char phys[39];
 };
 
 /*
@@ -254,7 +254,7 @@ static int sermouse_connect(struct serio
 		goto fail;
 
 	sermouse->dev = input_dev;
-	sprintf(sermouse->phys, "%s/input0", serio->phys);
+	snprintf(sermouse->phys, 39, "%s/input0", serio->phys);
 	sermouse->type = serio->id.proto;
 
 	input_dev->name = sermouse_protocols[sermouse->type];


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/