misc: modem_if: fix array-bounds in memcpy usage 02/220302/1
authorSeung-Woo Kim <sw0312.kim@samsung.com>
Tue, 17 Dec 2019 03:56:03 +0000 (12:56 +0900)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Tue, 17 Dec 2019 03:56:05 +0000 (12:56 +0900)
Fix array-bounds in memcpy usage by using bit size macro in size.
It is fixed as like tw3 kernel:
  https://git.tizen.org/cgit/profile/wearable/platform/kernel/linux-4.9-exynos9110/tree/drivers/misc/modem_v1/modem_main.c?h=tizen

Change-Id: Ie764e76c6eedcb696113837408a9994df6996bec
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
drivers/misc/modem_v1/modem_main.c

index 536b2fd..e294033 100644 (file)
@@ -85,7 +85,7 @@ static struct modem_shared *create_modem_shared_data(
        memset(msd->storage.addr, 0, size + (MAX_MIF_SEPA_SIZE * 2));
        memcpy(msd->storage.addr, MIF_SEPARATOR, strlen(MIF_SEPARATOR));
        msd->storage.addr += MAX_MIF_SEPA_SIZE;
-       memcpy(msd->storage.addr, &size, MAX_MIF_SEPA_SIZE);
+       memcpy(msd->storage.addr, &size, sizeof(int));
        msd->storage.addr += MAX_MIF_SEPA_SIZE;
        spin_lock_init(&msd->lock);