1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
From c787e02f7354f5310b0706b2e8eaee6f3617d9af Mon Sep 17 00:00:00 2001
From: Benjamin Hennion <benjamin.hennion@universite-paris-saclay.fr>
Date: Tue, 6 Sep 2022 17:00:12 +0200
Subject: [PATCH] Fix stack smashing due to mishandled ioctl bits reading
---
src/mimhwkeyboardtracker.cpp | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/mimhwkeyboardtracker.cpp b/src/mimhwkeyboardtracker.cpp
index d793ea06..7da8702b 100644
--- a/src/mimhwkeyboardtracker.cpp
+++ b/src/mimhwkeyboardtracker.cpp
@@ -120,7 +120,7 @@ void MImHwKeyboardTrackerPrivate::tryEvdevDevice(const char *device)
return;
}
- if (ioctl(fd, EVIOCGBIT(0, EV_MAX), evbits) < 0) {
+ if (ioctl(fd, EVIOCGBIT(0, sizeof(evbits)), evbits) < 0) {
delete qfile;
return;
}
@@ -131,14 +131,14 @@ void MImHwKeyboardTrackerPrivate::tryEvdevDevice(const char *device)
return;
}
- unsigned char swbit[BITS2BYTES(EV_MAX)];
- if (ioctl(fd, EVIOCGBIT(EV_SW, SW_CNT), swbit) < 0) {
+ unsigned char swCapabilities[BITS2BYTES(SW_MAX)];
+ if (ioctl(fd, EVIOCGBIT(EV_SW, sizeof(swCapabilities)), swCapabilities) < 0) {
delete qfile;
return;
}
// Check that there is a tablet mode switch here
- if (!TEST_BIT(SW_TABLET_MODE, swbit)) {
+ if (!TEST_BIT(SW_TABLET_MODE, swCapabilities)) {
delete qfile;
return;
}
@@ -152,11 +152,11 @@ void MImHwKeyboardTrackerPrivate::tryEvdevDevice(const char *device)
present = true;
// Initialise initial tablet mode state
- unsigned long state[BITS2BYTES(SW_MAX)];
- if (ioctl(fd, EVIOCGSW(SW_MAX), state) < 0)
+ unsigned char swState[BITS2BYTES(SW_MAX)];
+ if (ioctl(fd, EVIOCGSW(sizeof(swState)), swState) < 0)
return;
- evdevTabletMode = TEST_BIT(SW_TABLET_MODE, state);
+ evdevTabletMode = TEST_BIT(SW_TABLET_MODE, swState);
}
MImHwKeyboardTrackerPrivate::~MImHwKeyboardTrackerPrivate()
|
