Untested, since I'm unsure how to make xkbcomp go down this code path, but seems fairly obvious.
>From eeaa4aec798ef045d0b3b9de3c25932b85b9ac3d Mon Sep 17 00:00:00 2001 From: Alan Coopersmith <[email protected]> Date: Mon, 11 May 2009 09:39:03 -0700 Subject: [PATCH] Use temporary buffer for generating Uxxx names to avoid overflow Instead of sprintf()'ing a 4 character string to a char [4] buffer, and leaving the trailing '\0' to overwrite into the next entry, snprintf() to a 5 character temp buffer and memcpy the 4 characters to the right place. Fixes parfait errors: Error: Buffer overflow at xkbcomp-1.0.4/misc.c:393 in function 'ComputeKbdDefaults' [Standard C Library pattern matching] In sprintf related dereference of xkb->names->keys[i].name with index not less than '4' Destination array size is 4 bytes, data to be written is 4 bytes Error: Buffer overflow at xkbcomp-1.0.4/misc.c:402 in function 'ComputeKbdDefaults' [Standard C Library pattern matching] In sprintf related dereference of xkb->names->keys[i].name with index not less than '4' Destination array size is 4 bytes, data to be written is 4 bytes [This bug was found by the Parfait bug checking tool. For more information see http://research.sun.com/projects/parfait ] Signed-off-by: Alan Coopersmith <[email protected]> --- misc.c | 11 ++++++++--- 1 files changed, 8 insertions(+), 3 deletions(-) diff --git a/misc.c b/misc.c index 0e4f61d..4990a74 100644 --- a/misc.c +++ b/misc.c @@ -383,6 +383,7 @@ ComputeKbdDefaults(XkbDescPtr xkb) register int i, tmp, nUnknown; KeyNameDesc *name; KeySym *syms; + char tmpname[XkbKeyNameLength + 1]; if ((xkb->names == NULL) || (xkb->names->keys == NULL)) { @@ -430,8 +431,10 @@ ComputeKbdDefaults(XkbDescPtr xkb) ACTION2("Using <U%03d> for key %d\n", nUnknown, i); } - sprintf(xkb->names->keys[i].name, "U%03d", - nUnknown++); + snprintf(tmpname, sizeof(tmpname), "U%03d", + nUnknown++); + memcpy(xkb->names->keys[i].name, tmpname, + XkbKeyNameLength); } break; } @@ -442,7 +445,9 @@ ComputeKbdDefaults(XkbDescPtr xkb) { WARN1("Key %d does not match any defaults\n", i); ACTION1("Using name <U%03d>\n", nUnknown); - sprintf(xkb->names->keys[i].name, "U%03d", nUnknown++); + snprintf(tmpname, sizeof(tmpname), "U%03d", nUnknown++); + memcpy(xkb->names->keys[i].name, tmpname, + XkbKeyNameLength); } } } -- 1.5.6.5 _______________________________________________ xorg-devel mailing list [email protected] http://lists.x.org/mailman/listinfo/xorg-devel
