Skip to contentSkip to conversation

dfu:function: Fix number of allocated DFU function pointers

PATCH New Lukasz Majewski 3 participants 3 messages Jun 26, 2013 USB

lore
Share & tools
lore

Lukasz Majewski

author
#0 lore raw

PATCH 1/1 dfu:function: Fix number of allocated DFU function pointers

This subtle change fix problem with too small amount of allocated memory to store DFU function pointers.

One needs to allocate extra space for sentinel NULL pointer in this array of function pointers.

With the previous code, the NULL value overwrites malloc internal data and afterwards free(f_dfu->function) crashes.

Signed-off-by Lukasz Majewski <[email protected]>
Signed-off-by Kyungmin Park <[email protected]>
Cc Marek Vasut <[email protected]>
---
 drivers/usb/gadget/f_dfu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/f_dfu.c +1 -1
index 178a004..e3fa0e3 100644
@@ -589,7 +589,7 @@ static int dfu_prepare_function(struct f_dfu *f_dfu, int n)
 	struct usb_interface_descriptor *d;
 	int i = 0;
 
-	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n);
+	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 1);
 	if (!f_dfu->function)
 		goto enomem;
Signature · 1 line
1.7.10.4
#1 lore raw

PATCH 1/1 dfu:function: Fix number of allocated DFU function pointers

Hello Lukasz,

Am 26.06.2013 11:46, schrieb Lukasz Majewski:

Quoted 9 lines

This subtle change fix problem with too small amount of allocated memory to store DFU function pointers.

One needs to allocate extra space for sentinel NULL pointer in this array of function pointers.

With the previous code, the NULL value overwrites malloc internal data and afterwards free(f_dfu->function) crashes.

Quoted 6 lines
Signed-off-by Lukasz Majewski <[email protected]>
Signed-off-by Kyungmin Park <[email protected]>
Cc Marek Vasut <[email protected]>
---
 drivers/usb/gadget/f_dfu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Acked-by Heiko Schocher <[email protected]>

Thanks!

bye,
Heiko

Signature · 2 lines
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Applied
#2 lore raw

PATCH 1/1 dfu:function: Fix number of allocated DFU function pointers

Dear Heiko Schocher,

Quoted 17 lines

Hello Lukasz,

Am 26.06.2013 11:46, schrieb Lukasz Majewski:

Quoted 14 lines

This subtle change fix problem with too small amount of allocated memory to store DFU function pointers.

One needs to allocate extra space for sentinel NULL pointer in this array of function pointers.

With the previous code, the NULL value overwrites malloc internal data and afterwards free(f_dfu->function) crashes.

Signed-off-by Lukasz Majewski <[email protected]>
Signed-off-by Kyungmin Park <[email protected]>
Cc Marek Vasut <[email protected]>

---

Quoted 4 lines
Quoted 2 lines
 drivers/usb/gadget/f_dfu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Acked-by Heiko Schocher <[email protected]>

Applied, thanks

Best regards,
Marek Vasut