From: luliuhui <liuhui.lu@intel.com>
Date: Thu, 8 Mar 2012 02:35:26 +0000 (+0800)
Subject: Graphic: Critical Klocwork issues for ICS kernel
X-Git-Tag: 2.1b_release~1271
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=00f6a49f1a229bef488e691846a7dcd202a2c22d;p=kernel%2Fkernel-mfld-blackbay.git

Graphic: Critical Klocwork issues for ICS kernel

BZ: 23906

Revise NULL pointer dereferenced issues in kernel.
Revise buffer overflow issues in kernel.
For kw scan round #47.

Change-Id: I84323877ef00983e1cf5e43c580904945d8b9f2b
Signed-off-by: luliuhui <liuhui.lu@intel.com>
Reviewed-on: http://android.intel.com:8080/37895
Reviewed-by: Xu, Randy <randy.xu@intel.com>
Tested-by: Tong, BoX <box.tong@intel.com>
Reviewed-by: buildbot <buildbot@intel.com>
Tested-by: buildbot <buildbot@intel.com>
---

diff --git a/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c b/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c
index e9f7df5..1be4586 100644
--- a/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c
+++ b/drivers/staging/mrst/drv/mdfld_dsi_pkg_sender.c
@@ -65,7 +65,7 @@ const char * dsi_errors[] = {
 	"RX Prot Violation",
 	"HS Generic Write FIFO Full",
 	"LP Generic Write FIFO Full",
-	"Generic Read Data Avail"
+	"Generic Read Data Avail",
 	"Special Packet Sent",
 	"Tearing Effect",
 };
diff --git a/drivers/staging/mrst/drv/psb_drv.c b/drivers/staging/mrst/drv/psb_drv.c
index d8b2714..77bf6db 100644
--- a/drivers/staging/mrst/drv/psb_drv.c
+++ b/drivers/staging/mrst/drv/psb_drv.c
@@ -3924,7 +3924,7 @@ static __init int parse_hdmi_edid(char *arg)
 	if ((!arg) || (strlen(arg) >= 20))
 		return -EINVAL;
 
-	strncpy(HDMI_EDID, arg, sizeof(HDMI_EDID));
+	strncpy(HDMI_EDID, arg, strlen(arg));
 
 	return 0;
 }
diff --git a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c
index 7ea05fb..ab88cf9 100755
--- a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c
+++ b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/osfunc.c
@@ -2040,7 +2040,7 @@ PVRSRV_ERROR OSEventObjectCreateKM(const IMG_CHAR *pszName, PVRSRV_EVENTOBJECT *
 	if (pszName && strlen(pszName) <= EVENTOBJNAME_MAXLENGTH)
         {
             
-            strncpy(psEventObject->szName, pszName, EVENTOBJNAME_MAXLENGTH);
+            strncpy(psEventObject->szName, pszName, strlen(pszName));
         }
         else
         {
diff --git a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c
index ff27e71..c3d2b2d 100755
--- a/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c
+++ b/drivers/staging/mrst/pvr/services4/srvkm/env/linux/pvr_debug.c
@@ -174,6 +174,7 @@ IMG_VOID PVRSRVReleasePrintf(const IMG_CHAR *pszFormat, ...)
 	va_list vaArgs;
 	unsigned long ulLockFlags = 0;
 	IMG_CHAR *pszBuf;
+	const IMG_CHAR *pszName = "PVR_K: ";
 	IMG_UINT32 ui32BufSiz;
 
 	SelectBuffer(&pszBuf, &ui32BufSiz);
@@ -181,7 +182,7 @@ IMG_VOID PVRSRVReleasePrintf(const IMG_CHAR *pszFormat, ...)
 	va_start(vaArgs, pszFormat);
 
 	GetBufferLock(&ulLockFlags);
-	strncpy (pszBuf, "PVR_K: ", (ui32BufSiz -1));
+	strncpy (pszBuf, pszName, strlen(pszName));
 
 	if (VBAppend(pszBuf, ui32BufSiz, pszFormat, vaArgs))
 	{