From c787e02f7354f5310b0706b2e8eaee6f3617d9af Mon Sep 17 00:00:00 2001
From: Benjamin Hennion <benjamin.hennion@universite-paris-saclay.fr>
Date: Tue, 6 Sep 2022 17:00:12 +0200
Subject: [PATCH] Fix stack smashing due to mishandled ioctl bits reading

---
 src/mimhwkeyboardtracker.cpp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/mimhwkeyboardtracker.cpp b/src/mimhwkeyboardtracker.cpp
index d793ea06..7da8702b 100644
--- a/src/mimhwkeyboardtracker.cpp
+++ b/src/mimhwkeyboardtracker.cpp
@@ -120,7 +120,7 @@ void MImHwKeyboardTrackerPrivate::tryEvdevDevice(const char *device)
         return;
     }
 
-    if (ioctl(fd, EVIOCGBIT(0, EV_MAX), evbits) < 0) {
+    if (ioctl(fd, EVIOCGBIT(0, sizeof(evbits)), evbits) < 0) {
         delete qfile;
         return;
     }
@@ -131,14 +131,14 @@ void MImHwKeyboardTrackerPrivate::tryEvdevDevice(const char *device)
         return;
     }
 
-    unsigned char swbit[BITS2BYTES(EV_MAX)];
-    if (ioctl(fd, EVIOCGBIT(EV_SW, SW_CNT), swbit) < 0) {
+    unsigned char swCapabilities[BITS2BYTES(SW_MAX)];
+    if (ioctl(fd, EVIOCGBIT(EV_SW, sizeof(swCapabilities)), swCapabilities) < 0) {
         delete qfile;
         return;
     }
 
     // Check that there is a tablet mode switch here
-    if (!TEST_BIT(SW_TABLET_MODE, swbit)) {
+    if (!TEST_BIT(SW_TABLET_MODE, swCapabilities)) {
         delete qfile;
         return;
     }
@@ -152,11 +152,11 @@ void MImHwKeyboardTrackerPrivate::tryEvdevDevice(const char *device)
     present = true;
 
     // Initialise initial tablet mode state
-    unsigned long state[BITS2BYTES(SW_MAX)];
-    if (ioctl(fd, EVIOCGSW(SW_MAX), state) < 0)
+    unsigned char swState[BITS2BYTES(SW_MAX)];
+    if (ioctl(fd, EVIOCGSW(sizeof(swState)), swState) < 0)
         return;
 
-    evdevTabletMode = TEST_BIT(SW_TABLET_MODE, state);
+    evdevTabletMode = TEST_BIT(SW_TABLET_MODE, swState);
 }
 
 MImHwKeyboardTrackerPrivate::~MImHwKeyboardTrackerPrivate()