diff options
| author |   Larry Finger <Larry.Finger@lwfinger.net> | 2013-09-04 15:55:58 -0500 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-09-17 07:47:44 -0700 |
| commit | e255b0c6f745eac61a7971ff6f0f4f6bf9039374 (patch) | |
| tree | 4648109f6d00f03e7c1a8d1a53908ac1c4558c0e | |
| parent | staging: r8188eu: Remove unreachable code in core/rtw_br_ext.c (diff) | |
staging: r8188eu: Fix some smatch errors in core/rtw_efuse.c
Smatch reports the following situations:
drivers/staging/rtl8188eu/core/rtw_efuse.c:589 rtw_efuse_map_write() error: buffer overflow 'newdata' 8 <= 8
drivers/staging/rtl8188eu/core/rtw_efuse.c:598 rtw_efuse_map_write() error: buffer overflow 'newdata' 8 <= 8
drivers/staging/rtl8188eu/core/rtw_efuse.c:681 rtw_BT_efuse_map_write() error: buffer overflow 'newdata' 8 <= 8
drivers/staging/rtl8188eu/core/rtw_efuse.c:690 rtw_BT_efuse_map_write() error: buffer overflow 'newdata' 8 <= 8
In these cases, it is possible to write beyond the end of an array.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/rtl8188eu/core/rtw_efuse.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/staging/rtl8188eu/core/rtw_efuse.c b/drivers/staging/rtl8188eu/core/rtw_efuse.c index 869434c4cf69..ad1c174cd7ee 100644 --- a/drivers/staging/rtl8188eu/core/rtw_efuse.c +++ b/drivers/staging/rtl8188eu/core/rtw_efuse.c @@ -542,7 +542,7 @@ u8 rtw_efuse_map_write(struct adapter *padapter, u16 addr, u16 cnts, u8 *data) { u8 offset, word_en; u8 *map; - u8 newdata[PGPKT_DATA_SIZE]; + u8 newdata[PGPKT_DATA_SIZE + 1]; s32 i, idx; u8 ret = _SUCCESS; u16 mapLen = 0; @@ -564,7 +564,7 @@ u8 rtw_efuse_map_write(struct adapter *padapter, u16 addr, u16 cnts, u8 *data) offset = (addr >> 3); word_en = 0xF; - _rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE); + _rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE + 1); i = addr & 0x7; /* index of one package */ idx = 0; /* data index */ @@ -634,7 +634,7 @@ u8 rtw_BT_efuse_map_write(struct adapter *padapter, u16 addr, u16 cnts, u8 *data { u8 offset, word_en; u8 *map; - u8 newdata[PGPKT_DATA_SIZE]; + u8 newdata[PGPKT_DATA_SIZE + 1]; s32 i, idx; u8 ret = _SUCCESS; u16 mapLen = 0; @@ -656,7 +656,7 @@ u8 rtw_BT_efuse_map_write(struct adapter *padapter, u16 addr, u16 cnts, u8 *data offset = (addr >> 3); word_en = 0xF; - _rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE); + _rtw_memset(newdata, 0xFF, PGPKT_DATA_SIZE + 1); i = addr & 0x7; /* index of one package */ idx = 0; /* data index */ |