input: sunkbd.c - fix reading beyond end of keycode array [14/14]

input: sunkbd.c - fix reading beyond end of keycode array [14/14]

Post by Vojtech Pavli » Thu, 13 Feb 2003 13:20:14



You can pull this changeset from:
        bk://kernel.bkbits.net/vojtech/input

===================================================================


  input: sunkbd.c - fix reading beyond end of keycode array.

 sunkbd.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

===================================================================

diff -Nru a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
--- a/drivers/input/keyboard/sunkbd.c   Wed Feb 12 11:56:22 2003

        sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type);

        memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));
-       for (i = 0; i < 255; i++)
+       for (i = 0; i < 127; i++)
                set_bit(sunkbd->keycode[i], sunkbd->dev.keybit);
        clear_bit(0, sunkbd->dev.keybit);

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in

More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

 
 
 

input: sunkbd.c - fix reading beyond end of keycode array [14/14]

Post by Randy.Dunla » Thu, 13 Feb 2003 18:50:07


On Wed, 12 Feb 2003 12:07:57 +0100

| diff -Nru a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
| --- a/drivers/input/keyboard/sunkbd.c Wed Feb 12 11:56:22 2003
| +++ b/drivers/input/keyboard/sunkbd.c Wed Feb 12 11:56:22 2003

|       sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type);
|  
|       memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));
| -     for (i = 0; i < 255; i++)
| +     for (i = 0; i < 127; i++)
|               set_bit(sunkbd->keycode[i], sunkbd->dev.keybit);
|       clear_bit(0, sunkbd->dev.keybit);
|  

If sunkbd has a valid keycode 127, that new loop test won't handle it,
so it should/could be:
| +     for (i = 0; i < 128; i++)

--
~Randy
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in

More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

 
 
 

input: sunkbd.c - fix reading beyond end of keycode array [14/14]

Post by Vojtech Pavli » Fri, 14 Feb 2003 03:10:07



> On Wed, 12 Feb 2003 12:07:57 +0100

> | diff -Nru a/drivers/input/keyboard/sunkbd.c b/drivers/input/keyboard/sunkbd.c
> | --- a/drivers/input/keyboard/sunkbd.c    Wed Feb 12 11:56:22 2003
> | +++ b/drivers/input/keyboard/sunkbd.c    Wed Feb 12 11:56:22 2003

> |          sprintf(sunkbd->name, "Sun Type %d keyboard", sunkbd->type);
> |  
> |          memcpy(sunkbd->keycode, sunkbd_keycode, sizeof(sunkbd->keycode));
> | -        for (i = 0; i < 255; i++)
> | +        for (i = 0; i < 127; i++)
> |                  set_bit(sunkbd->keycode[i], sunkbd->dev.keybit);
> |          clear_bit(0, sunkbd->dev.keybit);
> |  

> If sunkbd has a valid keycode 127, that new loop test won't handle it,
> so it should/could be:
> | +        for (i = 0; i < 128; i++)

You're right. It doesn't, though.

--
Vojtech Pavlik
SuSE Labs
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in

More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/