linux-kernel - [PATCH] venus: hfi_parser: fix Source Matcher errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 12 Mar 2019 13:55:42 +0200
From:   Stanimir Varbanov <stanimir.varbanov@...aro.org>
To:     linux-media@...r.kernel.org
Cc:     linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Hans Verkuil <hverkuil@...all.nl>,
        Stanimir Varbanov <stanimir.varbanov@...aro.org>
Subject: [PATCH] venus: hfi_parser: fix Source Matcher errors

This fixes following Smatch errors:

hfi_parser.c:103 parse_profile_level() error: memcpy() 'proflevel'
too small (8 vs 128)

hfi_parser.c:129 parse_caps() error: memcpy() 'cap'
too small (16 vs 512)

Signed-off-by: Stanimir Varbanov <stanimir.varbanov@...aro.org>
---
 drivers/media/platform/qcom/venus/hfi_parser.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/qcom/venus/hfi_parser.c b/drivers/media/platform/qcom/venus/hfi_parser.c
index 2293d936e49c..d8b34a7a825f 100644
--- a/drivers/media/platform/qcom/venus/hfi_parser.c
+++ b/drivers/media/platform/qcom/venus/hfi_parser.c
@@ -96,11 +96,15 @@ parse_profile_level(struct venus_core *core, u32 codecs, u32 domain, void *data)
 	struct hfi_profile_level_supported *pl = data;
 	struct hfi_profile_level *proflevel = pl->profile_level;
 	struct hfi_profile_level pl_arr[HFI_MAX_PROFILE_COUNT] = {};
+	unsigned int i;
 
 	if (pl->profile_count > HFI_MAX_PROFILE_COUNT)
 		return;
 
-	memcpy(pl_arr, proflevel, pl->profile_count * sizeof(*proflevel));
+	for (i = 0; i < pl->profile_count; i++) {
+		pl_arr[i] = *proflevel;
+		proflevel++;
+	}
 
 	for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
 		       fill_profile_level, pl_arr, pl->profile_count);
@@ -122,11 +126,15 @@ parse_caps(struct venus_core *core, u32 codecs, u32 domain, void *data)
 	struct hfi_capability *cap = caps->data;
 	u32 num_caps = caps->num_capabilities;
 	struct hfi_capability caps_arr[MAX_CAP_ENTRIES] = {};
+	unsigned int i;
 
 	if (num_caps > MAX_CAP_ENTRIES)
 		return;
 
-	memcpy(caps_arr, cap, num_caps * sizeof(*cap));
+	for (i = 0; i < num_caps; i++) {
+		caps_arr[i] = *cap;
+		cap++;
+	}
 
 	for_each_codec(core->caps, ARRAY_SIZE(core->caps), codecs, domain,
 		       fill_caps, caps_arr, num_caps);
-- 
2.17.1