Graphic: Critical Klocwork issues for ICS kernel

BZ: 23906

Revise NULL pointer dereferenced issues in kernel.
Revise buffer overflow issues in kernel.
For kw scan round #47.

Change-Id: I84323877ef00983e1cf5e43c580904945d8b9f2b
Signed-off-by: luliuhui <liuhui.lu@intel.com>
Reviewed-on: http://android.intel.com:8080/37895
Reviewed-by: Xu, Randy <randy.xu@intel.com>
Tested-by: Tong, BoX <box.tong@intel.com>
Reviewed-by: buildbot <buildbot@intel.com>
Tested-by: buildbot <buildbot@intel.com>

diff --git a/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c b/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c
index e9f7df5..1be4586 100644 (file)
--- a/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c
+++ b/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c
@@ -65,7 +65,7 @@ const char * dsi_errors[] = {
        "RX Prot Violation",
        "HS Generic Write FIFO Full",
        "LP Generic Write FIFO Full",
-       "Generic Read Data Avail"
+       "Generic Read Data Avail",
        "Special Packet Sent",
        "Tearing Effect",
 };

diff --git a/drivers/staging/mrst/drv/psb_drv.c b/drivers/staging/mrst/drv/psb_drv.c
index d8b2714..77bf6db 100644 (file)
--- a/drivers/staging/mrst/drv/psb_drv.c
+++ b/drivers/staging/mrst/drv/psb_drv.c
@@ -3924,7 +3924,7 @@ static __init int parse_hdmi_edid(char *arg)
        if ((!arg) || (strlen(arg) >= 20))
                return -EINVAL;
 
-       strncpy(HDMI_EDID, arg, sizeof(HDMI_EDID));
+       strncpy(HDMI_EDID, arg, strlen(arg));
 
        return 0;
 }

diff --git a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c
index 7ea05fb..ab88cf9 100755 (executable)
--- a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c
+++ b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c
@@ -2040,7 +2040,7 @@ PVRSRV_ERROR OSEventObjectCreateKM(const IMG_CHAR *pszName, PVRSRV_EVENTOBJECT *
        if (pszName && strlen(pszName) <= EVENTOBJNAME_MAXLENGTH)
         {
             
-            strncpy(psEventObject->szName, pszName, EVENTOBJNAME_MAXLENGTH);
+            strncpy(psEventObject->szName, pszName, strlen(pszName));
         }
         else
         {

diff --git a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c
index ff27e71..c3d2b2d 100755 (executable)
--- a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c
+++ b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c
@@ -174,6 +174,7 @@ IMG_VOID PVRSRVReleasePrintf(const IMG_CHAR *pszFormat, ...)
        va_list vaArgs;
        unsigned long ulLockFlags = 0;
        IMG_CHAR *pszBuf;
+       const IMG_CHAR *pszName = "PVR_K: ";
        IMG_UINT32 ui32BufSiz;
 
        SelectBuffer(&pszBuf, &ui32BufSiz);
@@ -181,7 +182,7 @@ IMG_VOID PVRSRVReleasePrintf(const IMG_CHAR *pszFormat, ...)
        va_start(vaArgs, pszFormat);
 
        GetBufferLock(&ulLockFlags);
-       strncpy (pszBuf, "PVR_K: ", (ui32BufSiz -1));
+       strncpy (pszBuf, pszName, strlen(pszName));
 
        if (VBAppend(pszBuf, ui32BufSiz, pszFormat, vaArgs))
        {