The kernel copies up to sizeof(devname) bytes but doesn't null-terminate the string if the device name exceeds the size of the supplied buffer. --- src/evdev.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/src/evdev.c b/src/evdev.c index 5ad4d6b..d7e416a 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -572,6 +572,7 @@ evdev_device_create(struct weston_seat *seat, const char *path, int device_fd) device->fd = device_fd; ioctl(device->fd, EVIOCGNAME(sizeof(devname)), devname); + devname[sizeof(devname) - 1] = '\0'; device->devname = strdup(devname); if (!evdev_handle_device(device)) { -- 1.8.2.1 _______________________________________________ wayland-devel mailing list wayland-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/wayland-devel