提交 de591dac 编写于 作者: H Håvard Skinnemoen 提交者: David Woodhouse

MTD: Fix bug in fixup_convert_atmel_pri

The memset() in fixup_convert_atmel_pri is supposed to zero out
everything except the first 5 bytes in *extp, but it ends up zeroing
out something way outside the struct instead. Fix this potentially
dangerous code by casting the pointer to char * before doing
arithmetic.
Signed-off-by: NHåvard Skinnemoen <hskinnemoen@atmel.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
上级 d882687c
......@@ -175,7 +175,7 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param)
struct cfi_pri_atmel atmel_pri;
memcpy(&atmel_pri, extp, sizeof(atmel_pri));
memset(extp + 5, 0, sizeof(*extp) - 5);
memset((char *)extp + 5, 0, sizeof(*extp) - 5);
if (atmel_pri.Features & 0x02)
extp->EraseSuspend = 2;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册