public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Vojtech Pavlik <vojtech@suse.cz>
To: torvalds@osdl.org, dtor_core@ameritech.net,
	linux-kernel@vger.kernel.org, vojtech@suse.cz
Subject: [PATCH 5/26] fix checking whether new keycode fits size-wise
Date: Sun, 11 Sep 2005 00:34:11 +0200	[thread overview]
Message-ID: <11263916513180@midnight.ucw.cz> (raw)
In-Reply-To: <11263916511448@midnight.ucw.cz>

Subject: [PATCH] Input: fix checking whether new keycode fits size-wise
From: Ian Campbell <ijc@hellion.org.uk>
Date: 1125816074 -0500

When dev->keycodesize == sizeof(int) the old code produces
incorrect result.

Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

---

 drivers/char/keyboard.c |    2 +-
 drivers/input/evdev.c   |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

4cee99564db7f65a6f88e4b752da52768cde3802
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -200,7 +200,7 @@ int setkeycode(unsigned int scancode, un
 		return -EINVAL;
 	if (keycode < 0 || keycode > KEY_MAX)
 		return -EINVAL;
-	if (keycode >> (dev->keycodesize * 8))
+	if (dev->keycodesize < sizeof(keycode) && (keycode >> (dev->keycodesize * 8)))
 		return -EINVAL;
 
 	oldkey = SET_INPUT_KEYCODE(dev, scancode, keycode);
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -320,7 +320,7 @@ static long evdev_ioctl(struct file *fil
 			if (t < 0 || t >= dev->keycodemax || !dev->keycodesize) return -EINVAL;
 			if (get_user(v, ip + 1)) return -EFAULT;
 			if (v < 0 || v > KEY_MAX) return -EINVAL;
-			if (v >> (dev->keycodesize * 8)) return -EINVAL;
+			if (dev->keycodesize < sizeof(v) && (v >> (dev->keycodesize * 8))) return -EINVAL;
 			u = SET_INPUT_KEYCODE(dev, t, v);
 			clear_bit(u, dev->keybit);
 			set_bit(v, dev->keybit);


  reply	other threads:[~2005-09-10 22:41 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2005-09-10 22:32 [GIT PULL 0/26] Input update Vojtech Pavlik
2005-09-10 22:34 ` [PATCH 1/26] psmouse - add support for IBM TrackPoint devices Vojtech Pavlik
2005-09-10 22:34   ` [PATCH 2/26] rework psmouse attributes to reduce module size Vojtech Pavlik
2005-09-10 22:34     ` [PATCH 3/26] ALPS - fix wheel decoding Vojtech Pavlik
2005-09-10 22:34       ` [PATCH 4/26] psmouse - add new Logitech wheel mouse model Vojtech Pavlik
2005-09-10 22:34         ` Vojtech Pavlik [this message]
2005-09-10 22:34           ` [PATCH 6/26] i8042 - clean up initialization code; abort if we Vojtech Pavlik
2005-09-10 22:34             ` [PATCH 7/26] make i8042_platform_init return 'real' error code Vojtech Pavlik
2005-09-10 22:34               ` [PATCH 8/26] i8042 - fix IRQ printing when either KBD or AUX port Vojtech Pavlik
2005-09-10 22:34                 ` [PATCH 9/26] i8042 - add i8042.nokbd module option to allow supressing Vojtech Pavlik
2005-09-10 22:34                   ` [PATCH 10/26] i8042 - add Lifebook E4010 to MUX blacklist Vojtech Pavlik
2005-09-10 22:34                     ` [PATCH 11/26] recognize and ignore Logitech vendor usages in HID Vojtech Pavlik
2005-09-10 22:34                       ` [PATCH 12/26] add HID simulation mappings Vojtech Pavlik
2005-09-10 22:34                         ` [PATCH 13/26] HID - add more consumer usages Vojtech Pavlik
2005-09-10 22:34                           ` [PATCH 14/26] atkbd - handle keyboards generating scancode 0x7f Vojtech Pavlik
2005-09-10 22:34                             ` [PATCH 15/26] HID - handle multi-transascion reports Vojtech Pavlik
2005-09-10 22:34                               ` [PATCH 16/26] HID - add support for Logitech UltraX Media Remote control Vojtech Pavlik
2005-09-10 22:34                                 ` [PATCH 17/26] iforce - use wait_event_interruptible_timeout Vojtech Pavlik
2005-09-10 22:34                                   ` [PATCH 18/26] sunkbd - extend mapping to handle Type-6 Sun keyboards Vojtech Pavlik
2005-09-10 22:34                                     ` [PATCH 19/26] HID - fix URB success status handling Vojtech Pavlik
2005-09-10 22:34                                       ` [PATCH 20/26] HID - add a quirk for the Apple Powermouse Vojtech Pavlik
2005-09-10 22:34                                         ` [PATCH 21/26] HID - add the Trust Predator TH 400 gamepad to the badpad list Vojtech Pavlik
2005-09-10 22:34                                           ` [PATCH 22/26] HID - add mapping for Powerbook USB keyboard Vojtech Pavlik
2005-09-10 22:34                                             ` [PATCH 23/26] HID - add Wireless Security Lock to HID blacklist Vojtech Pavlik
2005-09-10 22:34                                               ` [PATCH 24/26] HIDDEV - make HIDIOCSREPORT wait IO completion Vojtech Pavlik
2005-09-10 22:34                                                 ` [PATCH 25/26] clean up whitespace and formatting in drivers/char/keyboard.c Vojtech Pavlik
2005-09-10 22:34                                                   ` [PATCH 26/26] i8042 - use kzalloc instead of kcalloc Vojtech Pavlik

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=11263916513180@midnight.ucw.cz \
    --to=vojtech@suse.cz \
    --cc=dtor_core@ameritech.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=torvalds@osdl.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox