[patch 23/24] Input - check keycodesize when adjusting keymaps

[Dmitry Torokhov <dtor_core@ameritech.net>]

[-- Attachment #1: input-check-keycodesize.patch --]
[-- Type: text/plain, Size: 1491 bytes --]

From: Vojtech Pavlik <vojtech@suse.cz>

Input: check keycodesize when adjusting keymaps

When changing key mappings we need to make sure that the new
keycode value can be stored in dev->keycodesize bytes.

Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
---

 drivers/char/keyboard.c |    4 ++--
 drivers/input/evdev.c   |    1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

Index: work/drivers/char/keyboard.c
===================================================================
--- work.orig/drivers/char/keyboard.c
+++ work/drivers/char/keyboard.c
@@ -198,10 +198,10 @@ int setkeycode(unsigned int scancode, un
 
 	if (scancode >= dev->keycodemax)
 		return -EINVAL;
-	if (keycode > KEY_MAX)
-		return -EINVAL;
 	if (keycode < 0 || keycode > KEY_MAX)
 		return -EINVAL;
+	if (keycode >> (dev->keycodesize * 8))
+		return -EINVAL;
 
 	oldkey = SET_INPUT_KEYCODE(dev, scancode, keycode);
 
Index: work/drivers/input/evdev.c
===================================================================
--- work.orig/drivers/input/evdev.c
+++ work/drivers/input/evdev.c
@@ -320,6 +320,7 @@ static long evdev_ioctl(struct file *fil
 			if (t < 0 || t >= dev->keycodemax || !dev->keycodesize) return -EINVAL;
 			if (get_user(v, ip + 1)) return -EFAULT;
 			if (v < 0 || v > KEY_MAX) return -EINVAL;
+			if (v >> (dev->keycodesize * 8)) return -EINVAL;
 			u = SET_INPUT_KEYCODE(dev, t, v);
 			clear_bit(u, dev->keybit);
 			set_bit(v, dev->keybit);