Array 'SigBuff' is filled incompletely.
Someone forget to multiply for the sizeof type.
This was partly found using a static code analysis program called cppcheck.
Signed-off-by: Rickard Strandqvist <rickard_strandqv...@spectrumdigital.se>
---
drivers/staging/bcm/nvm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/bcm/nvm.c b/drivers/staging/bcm/nvm.c
index 63be3be..d56ca3b 100644
--- a/drivers/staging/bcm/nvm.c
+++ b/drivers/staging/bcm/nvm.c
@@ -3591,7 +3591,7 @@ int BcmCopyISO(struct bcm_mini_adapter *Adapter, struct
bcm_flash2x_copy_section
if (IsThisHeaderSector == TRUE) {
/* If this is header sector write 0xFFFFFFFF at
the sig time and in last write sig */
- memcpy(SigBuff, Buff + sigOffset, MAX_RW_SIZE);
+ memcpy(SigBuff, Buff + sigOffset,
sizeof(SigBuff));
for (i = 0; i < MAX_RW_SIZE; i++)
*(Buff + sigOffset + i) = 0xFF;
@@ -3704,7 +3704,7 @@ int BcmCopyISO(struct bcm_mini_adapter *Adapter, struct
bcm_flash2x_copy_section
if (IsThisHeaderSector == TRUE) {
/* If this is header sector write 0xFFFFFFFF at
the sig time and in last write sig */
- memcpy(SigBuff, Buff + sigOffset, MAX_RW_SIZE);
+ memcpy(SigBuff, Buff + sigOffset,
sizeof(SigBuff));
for (i = 0; i < MAX_RW_SIZE; i++)
*(Buff + sigOffset + i) = 0xFF;
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
