hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

video: fbdev: metronomefb: two harmless off by one bugs 

par->metromem_cmd->args[] is an array of 31 elements of size u16.  Here
we have initialized the first "i" elements and want to set the rest to
zero.

The issue here is that ARRAY_SIZE(par->metromem_cmd->args) is 31 and not
32 as in the original code.  It means that we set ->csum to zero, but
that is harmless because we immediately set it to the correct value on
the next line.

Still, the buffer overflow upsets static checkers so let's correct the
math.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
This commit is contained in:
Dan Carpenter 2016-01-30 17:44:32 +03:00 committed by Tomi Valkeinen
parent 18558cae02
commit 17f2e8e1db
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/video/fbdev/metronomefb.c
View File

@ -354,7 +354,8 @@ static int metronome_powerup_cmd(struct metronomefb_par *par)
}
/* the rest are 0 */
memset((u8 *) (par->metromem_cmd->args + i), 0, (32-i)*2);
memset(&par->metromem_cmd->args[i], 0,
(ARRAY_SIZE(par->metromem_cmd->args) - i) * 2);
par->metromem_cmd->csum = cs;
@ -376,7 +377,8 @@ static int metronome_config_cmd(struct metronomefb_par *par)
memcpy(par->metromem_cmd->args, epd_frame_table[par->dt].config,
sizeof(epd_frame_table[par->dt].config));
/* the rest are 0 */
memset((u8 *) (par->metromem_cmd->args + 4), 0, (32-4)*2);
memset(&par->metromem_cmd->args[4], 0,
(ARRAY_SIZE(par->metromem_cmd->args) - 4) * 2);
par->metromem_cmd->csum = 0xCC10;
par->metromem_cmd->csum += calc_img_cksum(par->metromem_cmd->args, 4);