diff options
| author | Håvard Skinnemoen <hskinnemoen@atmel.com> | 2006-09-15 17:19:31 +0200 |
|---|---|---|
| committer | David Woodhouse <dwmw2@infradead.org> | 2006-09-16 13:54:17 +0100 |
| commit | de591dacf3034977b3fb94b61d08240c8b35c39d (patch) | |
| tree | dea9eb00d70b85c5bafba142ee0ea77369f4e4a5 /drivers | |
| parent | d882687c51b52424a56992578ce7636b3f3c8d41 (diff) | |
| download | op-kernel-dev-de591dacf3034977b3fb94b61d08240c8b35c39d.zip op-kernel-dev-de591dacf3034977b3fb94b61d08240c8b35c39d.tar.gz | |
MTD: Fix bug in fixup_convert_atmel_pri
The memset() in fixup_convert_atmel_pri is supposed to zero out
everything except the first 5 bytes in *extp, but it ends up zeroing
out something way outside the struct instead. Fix this potentially
dangerous code by casting the pointer to char * before doing
arithmetic.
Signed-off-by: Håvard Skinnemoen <hskinnemoen@atmel.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mtd/chips/cfi_cmdset_0002.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c index ddc5bd7..a482e89 100644 --- a/drivers/mtd/chips/cfi_cmdset_0002.c +++ b/drivers/mtd/chips/cfi_cmdset_0002.c @@ -175,7 +175,7 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param) struct cfi_pri_atmel atmel_pri; memcpy(&atmel_pri, extp, sizeof(atmel_pri)); - memset(extp + 5, 0, sizeof(*extp) - 5); + memset((char *)extp + 5, 0, sizeof(*extp) - 5); if (atmel_pri.Features & 0x02) extp->EraseSuspend = 2; |
