Skip to contentSkip to conversation

ST_CORE: Error triggered by convert "char" to "int"

PATCH In review channing 2 participants 2 messages Jan 10, 2013 Char and misc drivers

lore
Share & tools
lore

channing

author
#0 lore raw

PATCH 1/1 ST_CORE: Error triggered by convert "char" to "int"

When st driver decodes protocol index received from raw data, it does a value convert from "char" to "int". Because it's sign extension from bit8 to bit32, the "int" value maybe minus, in another word, the protocol index might be minus, but driver doesn't filter such case and may continue access memory pointed by this minus index.

This patch is to change the variable type of index from "int" to "unsigned char", so that it avoids do such kind of type conversion.

cc liu chuansheng <[email protected]>
---
 drivers/misc/ti-st/st_core.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
drivers/misc/ti-st/st_core.c +2 -1
index b90a224..0a14280 100644
@@ -240,7 +240,8 @@ void st_int_recv(void *disc_data,
 	char *ptr;
 	struct st_proto_s *proto;
 	unsigned short payload_len = 0;
-	int len = 0, type = 0;
+	int len = 0;
+	unsigned char type = 0;
 	unsigned char *plen;
 	struct st_data_s *st_gdata = (struct st_data_s *)disc_data;
 	unsigned long flags;
Signature · 1 line
1.7.1
Acked-by on v1 1/1
#1 lore raw
Quoted 18 lines

-----Original Message-----
From: Bi, Chao
Sent: Thursday, January 10, 2013 4:27 PM
To: [email protected]; [email protected]; [email protected]; [email protected]
Cc: Liu, Chuansheng; [email protected]
Subject: [PATCH] ST_CORE: Error triggered by convert "char" to "int"

When st driver decodes protocol index received from raw data, it does a value convert from "char" to "int". Because it's sign extension from bit8 to bit32, the "int" value maybe minus, in another word, the protocol index might be minus, but driver doesn't filter such case and may continue access memory pointed by this minus index.

Quoted 4 lines

This patch is to change the variable type of index from "int" to "unsigned char", so that it avoids do such kind of type conversion.

Some infos:
when the type is minus, it will cause panic, because the below code just consider type >= ST_MAX_CHANNELS case, no type < 0 case, but it really happened.

			if ((type >= ST_MAX_CHANNELS) ||
					(st_gdata->list[type] == NULL)) {

Changing type from int to unsigned char can get benefit from the above code.
If possible:

Thanks. ���{.n�+�������+%�����ݶ��w��{.n�+����{��G�����{ay�ʇڙ�,j��f���h��������z_�(�階�ݢj"���m������G������?����&���~��iO��z��v�^�m���� ������?�I�