summaryrefslogtreecommitdiffstats
path: root/drivers/misc
diff options
context:
space:
mode:
authorchanning <chao.bi@intel.com>2013-01-10 09:27:29 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-01-17 19:19:42 +0100
commit25c22d5bead5b0211f3ecc84fd6152dfdf95c75d (patch)
tree438db8f8c22d2247d6179cf003a56ecf17573e68 /drivers/misc
parentw1_therm: Retries: remove old code add CRC (diff)
downloadlinux-25c22d5bead5b0211f3ecc84fd6152dfdf95c75d.tar.xz
linux-25c22d5bead5b0211f3ecc84fd6152dfdf95c75d.zip
misc: st_core: Error triggered by convert "char" to "int"
When st driver decodes protocol index received from raw data, it does a value convert from "char" to "int". Because it's sign extension from bit8 to bit32, the "int" value maybe minus, in another word, the protocol index might be minus, but driver doesn't filter such case and may continue access memory pointed by this minus index. This patch is to change the variable type of index from "int" to "unsigned char", so that it avoids do such kind of type conversion. cc: liu chuansheng <chuansheng.liu@intel.com> Signed-off-by: channing <chao.bi@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/misc')
-rw-r--r--drivers/misc/ti-st/st_core.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index b90a2241d79c..0a1428016350 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -240,7 +240,8 @@ void st_int_recv(void *disc_data,
char *ptr;
struct st_proto_s *proto;
unsigned short payload_len = 0;
- int len = 0, type = 0;
+ int len = 0;
+ unsigned char type = 0;
unsigned char *plen;
struct st_data_s *st_gdata = (struct st_data_s *)disc_data;
unsigned long flags;