Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

misc: st_core: Error triggered by convert "char" to "int"

When st driver decodes protocol index received from raw data,
it does a value convert from "char" to "int". Because it's sign
extension from bit8 to bit32, the "int" value maybe minus, in
another word, the protocol index might be minus, but driver doesn't
filter such case and may continue access memory pointed by this
minus index.

This patch is to change the variable type of index from "int"
to "unsigned char", so that it avoids do such kind of type
conversion.

cc: liu chuansheng <chuansheng.liu@intel.com>
Signed-off-by: channing <chao.bi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

channing and committed by
Greg Kroah-Hartman
25c22d5b 867ff988

+2 -1
+2 -1
drivers/misc/ti-st/st_core.c
··· 240 240 char *ptr; 241 241 struct st_proto_s *proto; 242 242 unsigned short payload_len = 0; 243 - int len = 0, type = 0; 243 + int len = 0; 244 + unsigned char type = 0; 244 245 unsigned char *plen; 245 246 struct st_data_s *st_gdata = (struct st_data_s *)disc_data; 246 247 unsigned long flags;