[PATCH] staging: bcm: nvm.c: Cleaning up a array that is filled incompletely

[PATCH] staging: bcm: nvm.c: Cleaning up a array that is filled incompletely

[Rickard Strandqvist]

Hi

I think someone missed the count sizeof type in memcpy.

I'm no expert on this code.
But I wonder if also the the next for loop wrong?
It will fill with 0XFF00000000000000 but it is
not a complete 0XFFFFFFFFFFFFFFFF you're looking for?

So something like:
memset(&Buff[sigOffset], 0xFF, MAX_RW_SIZE * sizeof(PCHAR));

Rickard Strandqvist (1):
  MY_FIL_NAMN Cleaning up a array that is filled incompletely

 drivers/staging/bcm/nvm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
1.7.10.4

[PATCH] staging: bcm: nvm.c: Cleaning up a array that is filled incompletely

[Rickard Strandqvist]

Array 'SigBuff' is filled incompletely.
Someone forget to multiply for the sizeof type.

This was partly found using a static code analysis program called cppcheck.

Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
---
 drivers/staging/bcm/nvm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/bcm/nvm.c b/drivers/staging/bcm/nvm.c
index 63be3be..d56ca3b 100644
--- a/drivers/staging/bcm/nvm.c
+++ b/drivers/staging/bcm/nvm.c
@@ -3591,7 +3591,7 @@ int BcmCopyISO(struct bcm_mini_adapter *Adapter, struct bcm_flash2x_copy_section
 
 			if (IsThisHeaderSector == TRUE) {
 				/* If this is header sector write 0xFFFFFFFF at the sig time and in last write sig */
-				memcpy(SigBuff, Buff + sigOffset, MAX_RW_SIZE);
+				memcpy(SigBuff, Buff + sigOffset, sizeof(SigBuff));
 
 				for (i = 0; i < MAX_RW_SIZE; i++)
 					*(Buff + sigOffset + i) = 0xFF;
@@ -3704,7 +3704,7 @@ int BcmCopyISO(struct bcm_mini_adapter *Adapter, struct bcm_flash2x_copy_section
 
 			if (IsThisHeaderSector == TRUE) {
 				/* If this is header sector write 0xFFFFFFFF at the sig time and in last write sig */
-				memcpy(SigBuff, Buff + sigOffset, MAX_RW_SIZE);
+				memcpy(SigBuff, Buff + sigOffset, sizeof(SigBuff));
 
 				for (i = 0; i < MAX_RW_SIZE; i++)
 					*(Buff + sigOffset + i) = 0xFF;
-- 
1.7.10.4

Re: [PATCH] staging: bcm: nvm.c: Cleaning up a array that is filled incompletely

[Dan Carpenter]

On Sun, Jun 08, 2014 at 11:45:28PM +0200, Rickard Strandqvist wrote:
> Array 'SigBuff' is filled incompletely.
> Someone forget to multiply for the sizeof type.
> 
> This was partly found using a static code analysis program called cppcheck.
> 

I took a look at code which uses MAX_RW_SIZE and it's really confused
about whether it is in bytes or number of ints.

This code is a real mess.  For example, look at the call to:

			WriteToFlashWithoutSectorErase(Adapter,
                                                       SigBuff,
                                                       eISOWritePart,
                                                       sigOffset,
                                                       MAX_RW_SIZE);

If you look at it, that function says it takes int pointers but really
I think it wants u8 pointers.

I think this is the real fix here, to change
WriteToFlashWithoutSectorErase() to take char pointers and then make the
SigBuff buffer an array of u8.

I think this is the correct way to fix this code, but this driver is
very horrible so I could be wrong.  Please check.

regards,
dan carpenter

PS: These days I add everything to the TODO so we don't forget about it.

TODO-list: 2014-06-09: bcm: make SigBuff in BcmCopyISO() an array of u8.