Re: [PATCH] Input: sidewinder - size the name buffers to their formats

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

On Fri, Nov 06, 2026 at 11:33:00AM +0800, xujiahao wrote:
> sw_connect() composes the physical path of each port as "%s/input%d"
> from gameport->phys into a 32-byte array.  gameport->phys is a 32-byte
> string and the port number is an int, so the worst case is 31 + 6 + 10
> characters plus the terminator and does not fit.
> 
> sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte
> comment buffer of sw_connect().  The PnP ID is 7 characters, the
> revision string 8, and the %d arguments are a full-range int as far as
> the compiler can tell, so 44 characters plus the terminator do not fit
> either.
> 
> Size both buffers to their formats.  Truncation is theoretical with the
> values seen today, but a buffer should not be smaller than what it is
> asked to hold.  Building with W=1:
> 
>   drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
>   drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
> 
> Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
> ---
>  drivers/input/joystick/sidewinder.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
> index 7f37d18c8..2bd5cfe5c 100644
> --- a/drivers/input/joystick/sidewinder.c
> +++ b/drivers/input/joystick/sidewinder.c
> @@ -97,7 +97,7 @@ struct sw {
>  	struct gameport *gameport;
>  	struct input_dev *dev[4];
>  	char name[64];
> -	char phys[4][32];
> +	char phys[4][64];
>  	int length;
>  	int type;
>  	int bits;
> @@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
>  	unsigned char *buf = NULL;	/* [SW_LENGTH] */
>  	unsigned char *idbuf = NULL;	/* [SW_LENGTH] */
>  	unsigned char m = 1;
> -	char comment[40];
> +	char comment[48];

This just wastes memory for something that never happens. We are OK even
if data is truncated.

To shut off the warnings I think we can switch to scnprintf().

Thanks.

-- 
Dmitry