mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: channing <chao.bi@intel.com>
To: alan@linux.intel.com, gregkh@linuxfoundation.org,
	akpm@linux-foundation.org, pavan_savoy@ti.com
Cc: chuansheng.liu@intel.com, linux-kernel@vger.kernel.org
Subject: [PATCH] ST_CORE: Error triggered by convert "char" to "int"
Date: Thu, 10 Jan 2013 16:27:29 +0800	[thread overview]
Message-ID: <1357806449.8296.32.camel@bichao> (raw)


When st driver decodes protocol index received from raw data,
it does a value convert from "char" to "int". Because it's sign
extension from bit8 to bit32, the "int" value maybe minus, in
another word, the protocol index might be minus, but driver doesn't
filter such case and may continue access memory pointed by this
minus index.

This patch is to change the variable type of index from "int"
to "unsigned char", so that it avoids do such kind of type
conversion.

cc: liu chuansheng <chuansheng.liu@intel.com>
Signed-off-by: channing <chao.bi@intel.com>
---
 drivers/misc/ti-st/st_core.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index b90a224..0a14280 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -240,7 +240,8 @@ void st_int_recv(void *disc_data,
 	char *ptr;
 	struct st_proto_s *proto;
 	unsigned short payload_len = 0;
-	int len = 0, type = 0;
+	int len = 0;
+	unsigned char type = 0;
 	unsigned char *plen;
 	struct st_data_s *st_gdata = (struct st_data_s *)disc_data;
 	unsigned long flags;
-- 
1.7.1


             reply	other threads:[~2013-01-10  8:10 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-01-10  8:27 channing [this message]
2013-01-10  8:45 ` Liu, Chuansheng

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1357806449.8296.32.camel@bichao \
    --to=chao.bi@intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=alan@linux.intel.com \
    --cc=chuansheng.liu@intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=pavan_savoy@ti.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®