فهرست منبع

Input: fix checking whether new keycode fits size-wise

When dev->keycodesize == sizeof(int) the old code produces
incorrect result.

Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Ian Campbell 19 سال پیش
والد
کامیت
4cee99564d
2فایلهای تغییر یافته به همراه2 افزوده شده و 2 حذف شده
  1. 1 1
      drivers/char/keyboard.c
  2. 1 1
      drivers/input/evdev.c

+ 1 - 1
drivers/char/keyboard.c

@@ -200,7 +200,7 @@ int setkeycode(unsigned int scancode, unsigned int keycode)
 		return -EINVAL;
 		return -EINVAL;
 	if (keycode < 0 || keycode > KEY_MAX)
 	if (keycode < 0 || keycode > KEY_MAX)
 		return -EINVAL;
 		return -EINVAL;
-	if (keycode >> (dev->keycodesize * 8))
+	if (dev->keycodesize < sizeof(keycode) && (keycode >> (dev->keycodesize * 8)))
 		return -EINVAL;
 		return -EINVAL;
 
 
 	oldkey = SET_INPUT_KEYCODE(dev, scancode, keycode);
 	oldkey = SET_INPUT_KEYCODE(dev, scancode, keycode);

+ 1 - 1
drivers/input/evdev.c

@@ -320,7 +320,7 @@ static long evdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 			if (t < 0 || t >= dev->keycodemax || !dev->keycodesize) return -EINVAL;
 			if (t < 0 || t >= dev->keycodemax || !dev->keycodesize) return -EINVAL;
 			if (get_user(v, ip + 1)) return -EFAULT;
 			if (get_user(v, ip + 1)) return -EFAULT;
 			if (v < 0 || v > KEY_MAX) return -EINVAL;
 			if (v < 0 || v > KEY_MAX) return -EINVAL;
-			if (v >> (dev->keycodesize * 8)) return -EINVAL;
+			if (dev->keycodesize < sizeof(v) && (v >> (dev->keycodesize * 8))) return -EINVAL;
 			u = SET_INPUT_KEYCODE(dev, t, v);
 			u = SET_INPUT_KEYCODE(dev, t, v);
 			clear_bit(u, dev->keybit);
 			clear_bit(u, dev->keybit);
 			set_bit(v, dev->keybit);
 			set_bit(v, dev->keybit);