summaryrefslogtreecommitdiff
path: root/drivers/video
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2016-01-30 17:44:32 +0300
committerTomi Valkeinen <tomi.valkeinen@ti.com>2016-02-16 14:52:43 +0200
commit17f2e8e1dbe2cae66e99fd1a684db10bde792570 (patch)
treee795ddcfffa1e92fb59b95a5fca8b0665e2a3534 /drivers/video
parent18558cae0272f8fd9647e69d3fec1565a7949865 (diff)
video: fbdev: metronomefb: two harmless off by one bugs
par->metromem_cmd->args[] is an array of 31 elements of size u16. Here we have initialized the first "i" elements and want to set the rest to zero. The issue here is that ARRAY_SIZE(par->metromem_cmd->args) is 31 and not 32 as in the original code. It means that we set ->csum to zero, but that is harmless because we immediately set it to the correct value on the next line. Still, the buffer overflow upsets static checkers so let's correct the math. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/fbdev/metronomefb.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/video/fbdev/metronomefb.c b/drivers/video/fbdev/metronomefb.c
index ad04a01e2761..abb6bbf226d5 100644
--- a/drivers/video/fbdev/metronomefb.c
+++ b/drivers/video/fbdev/metronomefb.c
@@ -354,7 +354,8 @@ static int metronome_powerup_cmd(struct metronomefb_par *par)
}
/* the rest are 0 */
- memset((u8 *) (par->metromem_cmd->args + i), 0, (32-i)*2);
+ memset(&par->metromem_cmd->args[i], 0,
+ (ARRAY_SIZE(par->metromem_cmd->args) - i) * 2);
par->metromem_cmd->csum = cs;
@@ -376,7 +377,8 @@ static int metronome_config_cmd(struct metronomefb_par *par)
memcpy(par->metromem_cmd->args, epd_frame_table[par->dt].config,
sizeof(epd_frame_table[par->dt].config));
/* the rest are 0 */
- memset((u8 *) (par->metromem_cmd->args + 4), 0, (32-4)*2);
+ memset(&par->metromem_cmd->args[4], 0,
+ (ARRAY_SIZE(par->metromem_cmd->args) - 4) * 2);
par->metromem_cmd->csum = 0xCC10;
par->metromem_cmd->csum += calc_img_cksum(par->metromem_cmd->args, 4);