evdev: prevent unterminated device name
authorPeter Hutterer <peter.hutterer@who-t.net>
Wed, 7 Aug 2013 01:04:41 +0000 (11:04 +1000)
committerJonas Ådahl <jadahl@gmail.com>
Sun, 10 Nov 2013 16:51:32 +0000 (17:51 +0100)
The kernel copies up to sizeof(devname) bytes but doesn't null-terminate the
string if the device name exceeds the size of the supplied buffer.

src/evdev.c

index fc5004c..27296f8 100644 (file)
@@ -575,6 +575,7 @@ evdev_device_create(struct weston_seat *seat, const char *path, int device_fd)
        device->fd = device_fd;
 
        ioctl(device->fd, EVIOCGNAME(sizeof(devname)), devname);
+       devname[sizeof(devname) - 1] = '\0';
        device->devname = strdup(devname);
 
        if (!evdev_handle_device(device)) {