sata_sil24: memset() overflow
cb->atapi.cdb is an array of 16 u8 elements. The call too memset() would set the first part of the sge array to zero as well. It's not a packed struct. This one has been around for five years. I found it with Smatch. I think the reason no one has seen it before is because we normally call sil24_fill_sg() and that overwrites sge with proper information? Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
This commit is contained in:
parent
7908a9e5fc
commit
14e45c15e1
|
@ -865,7 +865,7 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
|
||||||
} else {
|
} else {
|
||||||
prb = &cb->atapi.prb;
|
prb = &cb->atapi.prb;
|
||||||
sge = cb->atapi.sge;
|
sge = cb->atapi.sge;
|
||||||
memset(cb->atapi.cdb, 0, 32);
|
memset(cb->atapi.cdb, 0, sizeof(cb->atapi.cdb));
|
||||||
memcpy(cb->atapi.cdb, qc->cdb, qc->dev->cdb_len);
|
memcpy(cb->atapi.cdb, qc->cdb, qc->dev->cdb_len);
|
||||||
|
|
||||||
if (ata_is_data(qc->tf.protocol)) {
|
if (ata_is_data(qc->tf.protocol)) {
|
||||||
|
|
Loading…
Reference in New Issue