I found a little mistake. 
 On TOSHIBA Cell refference system(BIG_ENDIAN systems) a buffer overflow
was occured when I specified smaller buffers than maxlen.


Best regards,

Kenichi Nagai
Semiconductor Company
TOSHIBA Corporation
[EMAIL PROTECTED]


Signed-off-by: Kenichi Nagai <[EMAIL PROTECTED]>
---
 
--- drivers/input/evdev.c.orig  2007-04-14 05:48:14.000000000 +0900
+++ drivers/input/evdev.c       2007-04-19 09:36:19.000000000 +0900
@@ -320,7 +320,7 @@ static int bits_to_user(unsigned long *b

        if (compat) {
                len = NBITS_COMPAT(maxbit) * sizeof(compat_long_t);
-               if (len < maxlen)
+               if (len > maxlen)
                        len = maxlen;

                for (i = 0; i < len / sizeof(compat_long_t); i++)



Reply via email to