Fix Security Svace issue 06/149406/2 accepted/tizen/unified/20170918.093916 submit/tizen/20170915.102550
authorjino.cho <jino.cho@samsung.com>
Tue, 12 Sep 2017 07:45:06 +0000 (16:45 +0900)
committerjino.cho <jino.cho@samsung.com>
Tue, 12 Sep 2017 07:57:11 +0000 (16:57 +0900)
This patch fixes security issue from SVACE.
"WID:31524889 Casting 'num' [ unsigned int *] to _Bool * makes
a pointer with a different pointee size. It can lead to
out-of-bounds memory access when dereferenced."

Change-Id: If3620630eaa8607d132da751f5ce2dc485b69ce4
Signed-off-by: jino.cho <jino.cho@samsung.com>
test/samples/mma7455.c

index 31e2bb2c1f29e29ab08577c801ef6f9ad7b6116c..1930b741d8fede7cdc9dd1ba4d0311c6e158189d 100644 (file)
@@ -261,7 +261,10 @@ static int mma7455_spi_mctl_write_byte(unsigned char value)
 
 int mma7455_spi_init(int bus_num, int cs_num)
 {
-       unsigned int num;
+       peripheral_spi_mode_e spi_mode;
+       bool spi_lsb;
+       unsigned char spi_bits;
+       unsigned int spi_freq;
        int ret;
 
        /* Return if it's already initialized */
@@ -282,15 +285,12 @@ int mma7455_spi_init(int bus_num, int cs_num)
        peripheral_spi_set_bits_per_word(mma7455_spi, 8);
        peripheral_spi_set_frequency(mma7455_spi, 8*1024*1024);
 
-       LOG("bus : %d, cs : %d, ", bus_num, cs_num);
-       peripheral_spi_get_mode(mma7455_spi, (peripheral_spi_mode_e*)&num);
-       LOG("mode : %d, ", num);
-       peripheral_spi_get_lsb_first(mma7455_spi, (bool*)&num);
-       LOG("lsb first : %d, ", (bool)num);
-       peripheral_spi_get_bits_per_word(mma7455_spi, (unsigned char*)&num);
-       LOG("bits : %d, ", (unsigned char)num);
-       peripheral_spi_get_frequency(mma7455_spi, &num);
-       LOG("max frequency : %d\n", num);
+       peripheral_spi_get_mode(mma7455_spi, &spi_mode);
+       peripheral_spi_get_lsb_first(mma7455_spi, &spi_lsb);
+       peripheral_spi_get_bits_per_word(mma7455_spi, &spi_bits);
+       peripheral_spi_get_frequency(mma7455_spi, &spi_freq);
+       LOG("bus : %d, cs : %d, mode : %d, lsb first : %d, bits : %d, max frequency : %d\n",
+                       bus_num, cs_num, spi_mode, spi_lsb, spi_bits, spi_freq);
 
        /* Set mode control register */
        ret = mma7455_spi_mctl_write_byte(MMA7455_MCTL_SPI3W