On Thu, 15 Oct 2015 15:47:39 +0300
Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> On Thu, Oct 15, 2015 at 01:28:52PM +0200, Christian Gromm wrote:
> > This patch changes the data type from u32 to u16 used for temporary
> > variable. It is needed to stay in the correct range and get rid of
> > the unnecessary cast.
> >
> > Signed-off-by: Christian Gromm <christian.gromm@xxxxxxxxxxxxx>
> > ---
> > drivers/staging/most/hdm-dim2/dim2_hdm.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/staging/most/hdm-dim2/dim2_hdm.c b/drivers/staging/most/hdm-dim2/dim2_hdm.c
> > index 45b8332..dda02a6 100644
> > --- a/drivers/staging/most/hdm-dim2/dim2_hdm.c
> > +++ b/drivers/staging/most/hdm-dim2/dim2_hdm.c
> > @@ -381,11 +381,11 @@ static void service_done_flag(struct dim2_hdm *dev, int ch_idx)
> > if (hdm_ch->data_type == MOST_CH_CONTROL ||
> > hdm_ch->data_type == MOST_CH_ASYNC) {
> >
> > - u32 const data_size =
> > - (u32)data[0] * 256 + data[1] + 2;
> > + u16 const data_size =
> > + (u16)data[0] * 256 + data[1] + 2;
>
> data is a u8 pointer. The cast makes no sense, because integer
> promotion means it is cast to int anyway. The const makes no sense.
> We have introduced the possibility of an integer overflow bug by
> changing the type to u16. I don't know if that matters...
With the used protocol in mind, data_size will not exceed the range
of an u16. But you're right: when the devil cannot come, he will send.
I'll fix this up.
Thanks,
Chris
>
>
> regards,
> dan carpenter
>
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
