From: Manjunatha Halli <x0130808@xxxxxx> ->dlen is 8 bit long and so while memcpy there is a chance that fmdev->irq_info.flag will overflow. So this patch removes memcpy and instead copies the 16bit flag register value from skb->data to fmdev->irq_info.flag directly. Change-Id: I37604b91b2777ed9e56a7e1c1ecefe32e9024170 Signed-off-by: Manjunatha Halli <x0130808@xxxxxx> --- drivers/media/radio/wl128x/fmdrv_common.c | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index bf867a6..54c549b 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -584,18 +584,16 @@ static void fm_irq_send_flag_getcmd(struct fmdev *fmdev) static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev) { struct sk_buff *skb; - struct fm_event_msg_hdr *fm_evt_hdr; if (check_cmdresp_status(fmdev, &skb)) return; - fm_evt_hdr = (void *)skb->data; - /* Skip header info and copy only response data */ skb_pull(skb, sizeof(struct fm_event_msg_hdr)); - memcpy(&fmdev->irq_info.flag, skb->data, fm_evt_hdr->dlen); - fmdev->irq_info.flag = be16_to_cpu(fmdev->irq_info.flag); + /* Copy 16 bit flag register value from skb->data */ + fmdev->irq_info.flag = (u16) ((skb->data[0] << 8) | skb->data[1]); + fmdbg("irq: flag register(0x%x)\n", fmdev->irq_info.flag); /* Continue next function in interrupt handler table */ -- 1.7.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html