From: channing <chao.bi@intel.com>
To: alan@linux.intel.com, gregkh@linuxfoundation.org,
akpm@linux-foundation.org, pavan_savoy@ti.com
Cc: chuansheng.liu@intel.com, linux-kernel@vger.kernel.org
Subject: [PATCH] ST_CORE: Error triggered by convert "char" to "int"
Date: Thu, 10 Jan 2013 16:27:29 +0800 [thread overview]
Message-ID: <1357806449.8296.32.camel@bichao> (raw)
When st driver decodes protocol index received from raw data,
it does a value convert from "char" to "int". Because it's sign
extension from bit8 to bit32, the "int" value maybe minus, in
another word, the protocol index might be minus, but driver doesn't
filter such case and may continue access memory pointed by this
minus index.
This patch is to change the variable type of index from "int"
to "unsigned char", so that it avoids do such kind of type
conversion.
cc: liu chuansheng <chuansheng.liu@intel.com>
Signed-off-by: channing <chao.bi@intel.com>
---
drivers/misc/ti-st/st_core.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index b90a224..0a14280 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -240,7 +240,8 @@ void st_int_recv(void *disc_data,
char *ptr;
struct st_proto_s *proto;
unsigned short payload_len = 0;
- int len = 0, type = 0;
+ int len = 0;
+ unsigned char type = 0;
unsigned char *plen;
struct st_data_s *st_gdata = (struct st_data_s *)disc_data;
unsigned long flags;
--
1.7.1
next reply other threads:[~2013-01-10 8:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-10 8:27 channing [this message]
2013-01-10 8:45 ` Liu, Chuansheng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1357806449.8296.32.camel@bichao \
--to=chao.bi@intel.com \
--cc=akpm@linux-foundation.org \
--cc=alan@linux.intel.com \
--cc=chuansheng.liu@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pavan_savoy@ti.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®