diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2014-02-27 11:36:04 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2014-03-06 09:21:02 +1000 |
| commit | 2e06aed955f55f704b14c265391dc2ce418b8e9f (patch) | |
| tree | eedcedd5948c5a8097e404c996bc349751b793ab /libevdev/libevdev.c | |
| parent | 5b0b2ae114ef366e3d524236df445f41f575609f (diff) | |
| download | libevdev-2e06aed955f55f704b14c265391dc2ce418b8e9f.tar.gz | |
Don't sync past MAX_SLOTS slots
If a device has more than MAX_SLOTS slots, we'd run out-of-bounds on the sync
array. This function is sig-safe, so we can't alloc here, merely limit the
access.
Reported-by: Jonas Ådahl <jadahl@gmail.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Diffstat (limited to 'libevdev/libevdev.c')
| -rw-r--r-- | libevdev/libevdev.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libevdev/libevdev.c b/libevdev/libevdev.c index 6127e64..36359d4 100644 --- a/libevdev/libevdev.c +++ b/libevdev/libevdev.c @@ -561,7 +561,7 @@ sync_mt_state(struct libevdev *dev, int create_events) ioctl_success = 1; } - for (i = 0; i < dev->num_slots; i++) { + for (i = 0; i < min(dev->num_slots, MAX_SLOTS); i++) { int j; struct input_event *ev; |