summary |
shortlog |
log |
commit | commitdiff |
review |
tree
raw |
patch |
inline | side by side (from parent 1:
6ebc6eb)
in the worst case scenario this leads to segfault in a hard-to-debug way.
Change-Id: I165adae0bd2dee26af777a2665c8c124d3a49808
Signed-off-by: Koichiro Den <den@klaipeden.com>
l1 = sizeof (memif_region_details_t) * md->regions_num;
if (l0 + l1 <= buflen)
{
l1 = sizeof (memif_region_details_t) * md->regions_num;
if (l0 + l1 <= buflen)
{
- md->regions = (memif_region_details_t *) buf + l0;
+ md->regions = (memif_region_details_t *) (buf + l0);
for (i = 0; i < md->regions_num; i++)
{
md->regions[i].index = i;
for (i = 0; i < md->regions_num; i++)
{
md->regions[i].index = i;
l1 = sizeof (memif_queue_details_t) * md->rx_queues_num;
if (l0 + l1 <= buflen)
{
l1 = sizeof (memif_queue_details_t) * md->rx_queues_num;
if (l0 + l1 <= buflen)
{
- md->rx_queues = (memif_queue_details_t *) buf + l0;
+ md->rx_queues = (memif_queue_details_t *) (buf + l0);
for (i = 0; i < md->rx_queues_num; i++)
{
md->rx_queues[i].region = c->rx_queues[i].region;
for (i = 0; i < md->rx_queues_num; i++)
{
md->rx_queues[i].region = c->rx_queues[i].region;
l1 = sizeof (memif_queue_details_t) * md->tx_queues_num;
if (l0 + l1 <= buflen)
{
l1 = sizeof (memif_queue_details_t) * md->tx_queues_num;
if (l0 + l1 <= buflen)
{
- md->tx_queues = (memif_queue_details_t *) buf + l0;
+ md->tx_queues = (memif_queue_details_t *) (buf + l0);
for (i = 0; i < md->tx_queues_num; i++)
{
md->tx_queues[i].region = c->tx_queues[i].region;
for (i = 0; i < md->tx_queues_num; i++)
{
md->tx_queues[i].region = c->tx_queues[i].region;