From 11f5bfbc09d0155905ab7f97b55d2e31445bc8c2 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Wed, 7 Aug 2013 11:04:41 +1000 Subject: [PATCH] evdev: prevent unterminated device name The kernel copies up to sizeof(devname) bytes but doesn't null-terminate the string if the device name exceeds the size of the supplied buffer. --- src/evdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/evdev.c b/src/evdev.c index fc5004c2..27296f8d 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -575,6 +575,7 @@ evdev_device_create(struct weston_seat *seat, const char *path, int device_fd) device->fd = device_fd; ioctl(device->fd, EVIOCGNAME(sizeof(devname)), devname); + devname[sizeof(devname) - 1] = '\0'; device->devname = strdup(devname); if (!evdev_handle_device(device)) {