diff options
| author |   Koichiro Den <den@klaipeden.com> | 2019-01-03 00:22:24 +0900 |
|---|---|---|
| committer |   Florin Coras <florin.coras@gmail.com> | 2019-01-04 19:55:33 +0000 |
| commit | 33331edd3ab8c2c2109203be7568587664f08abc (patch) | |
| tree | 6f92f8a7f452e26c614b3d8322c5b742d28834d9 | |
| parent | 6ebc6eb3d27e0abbc66dbb2548808e1a338f89b4 (diff) | |
libmemif: fix incorrect write leading to memory corruption
in the worst case scenario this leads to segfault in a hard-to-debug way.
Change-Id: I165adae0bd2dee26af777a2665c8c124d3a49808
Signed-off-by: Koichiro Den <den@klaipeden.com>
| -rw-r--r-- | extras/libmemif/src/main.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/extras/libmemif/src/main.c b/extras/libmemif/src/main.c index ab7a2f04c14..b2da9fa8513 100644 --- a/extras/libmemif/src/main.c +++ b/extras/libmemif/src/main.c @@ -2073,7 +2073,7 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md, l1 = sizeof (memif_region_details_t) * md->regions_num; if (l0 + l1 <= buflen) { - md->regions = (memif_region_details_t *) buf + l0; + md->regions = (memif_region_details_t *) (buf + l0); for (i = 0; i < md->regions_num; i++) { md->regions[i].index = i; @@ -2094,7 +2094,7 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md, l1 = sizeof (memif_queue_details_t) * md->rx_queues_num; if (l0 + l1 <= buflen) { - md->rx_queues = (memif_queue_details_t *) buf + l0; + md->rx_queues = (memif_queue_details_t *) (buf + l0); for (i = 0; i < md->rx_queues_num; i++) { md->rx_queues[i].region = c->rx_queues[i].region; @@ -2117,7 +2117,7 @@ memif_get_details (memif_conn_handle_t conn, memif_details_t * md, l1 = sizeof (memif_queue_details_t) * md->tx_queues_num; if (l0 + l1 <= buflen) { - md->tx_queues = (memif_queue_details_t *) buf + l0; + md->tx_queues = (memif_queue_details_t *) (buf + l0); for (i = 0; i < md->tx_queues_num; i++) { md->tx_queues[i].region = c->tx_queues[i].region; |