Skip to contentSkip to conversation

ARM:plat-s3c24xx: for memcpy, reading more things out of boundary

PATCH New Chen Gang 1 participant 2 messages Jan 24, 2013 – Feb 17, 2013

Subsystems (3)
lore
Share & tools
lore

Chen Gang

author
#0 lore raw

PATCH 1/1 ARM:plat-s3c24xx: for memcpy, reading more things out of boundary

the size is made by "plls_no + 1".
so when copy from original buffer, need dec 1, or reading out of boundary.

additional info:
plls_no is ARRARY_SIZE(plls).

---
 arch/arm/plat-s3c24xx/cpu-freq.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/plat-s3c24xx/cpu-freq.c +2 -1
index 4680799..df093b2 100644
@@ -700,7 +700,8 @@ int __init s3c_plltab_register(struct cpufreq_frequency_table *plls,
 
 	vals = kmalloc(size, GFP_KERNEL);
 	if (vals) {
-		memcpy(vals, plls, size);
+		memcpy(vals, plls,
+			size - sizeof(struct cpufreq_frequency_table));
 		pll_reg = vals;
 
 		/* write a terminating entry, we don't store it in the
Signature · 1 line
1.7.10.4
author
#1 lore raw

PATCH 1/1 ARM:plat-s3c24xx: for memcpy, reading more things out of boundary

Hello relative members:

please give a glance for this patch, when you have time.

thanks.

:-)

gchen.

? 2013?01?24? 13:27, Chen Gang ??:

Quoted 28 lines

the size is made by "plls_no + 1".
so when copy from original buffer, need dec 1, or reading out of boundary.

additional info:
plls_no is ARRARY_SIZE(plls).

---
 arch/arm/plat-s3c24xx/cpu-freq.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/plat-s3c24xx/cpu-freq.c +2 -1
index 4680799..df093b2 100644
@@ -700,7 +700,8 @@ int __init s3c_plltab_register(struct cpufreq_frequency_table *plls,
 
 	vals = kmalloc(size, GFP_KERNEL);
 	if (vals) {
-		memcpy(vals, plls, size);
+		memcpy(vals, plls,
+			size - sizeof(struct cpufreq_frequency_table));
 		pll_reg = vals;
 
 		/* write a terminating entry, we don't store it in the
Signature · 3 lines
Chen Gang

Asianux Corporation