This patch fixes wrong casting. A high value of "len" is casted to negative and thus the minimum resulting in memory corruption. Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Signed-off-by: Christian Gromm <christian.gromm@xxxxxxxxxxxxx> --- drivers/staging/most/mostcore/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/most/mostcore/core.c b/drivers/staging/most/mostcore/core.c index f4f9034..d566d8e 100644 --- a/drivers/staging/most/mostcore/core.c +++ b/drivers/staging/most/mostcore/core.c @@ -973,7 +973,7 @@ static ssize_t store_add_link(struct most_aim_obj *aim_obj, char *mdev_devnod; char devnod_buf[STRING_SIZE]; int ret; - unsigned int max_len = min((int)len + 1, STRING_SIZE); + size_t max_len = min(len + 1, (size_t)STRING_SIZE); strlcpy(buffer, buf, max_len); strlcpy(aim_obj->add_link, buf, max_len); @@ -1036,7 +1036,7 @@ static ssize_t store_remove_link(struct most_aim_obj *aim_obj, char *mdev; char *mdev_ch; int ret; - unsigned int max_len = min((int)len + 1, STRING_SIZE); + size_t max_len = min(len + 1, (size_t)STRING_SIZE); strlcpy(buffer, buf, max_len); strlcpy(aim_obj->remove_link, buf, max_len); -- 1.7.9.5 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
