diff options
| author | Lukasz Majewski <[email protected]> | 2013-06-26 11:46:13 +0200 |
|---|---|---|
| committer | Marek Vasut <[email protected]> | 2013-06-30 18:41:08 +0200 |
| commit | e059a400ad780328cd5ad22c396298cac520c856 (patch) | |
| tree | 8576ec1b6d6b7287a9a2ef05e8f3454a7f3236d1 /drivers | |
| parent | 7a3427854243f0e28c102926d203709b3e3cee62 (diff) | |
dfu:function: Fix number of allocated DFU function pointers
This subtle change fix problem with too small amount of allocated
memory to store DFU function pointers.
One needs to allocate extra space for sentinel NULL pointer in this array
of function pointers.
With the previous code, the NULL value overwrites malloc internal data
and afterwards free(f_dfu->function) crashes.
Signed-off-by: Lukasz Majewski <[email protected]>
Signed-off-by: Kyungmin Park <[email protected]>
Cc: Marek Vasut <[email protected]>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/gadget/f_dfu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c index 178a0044c46..e3fa0e373d1 100644 --- a/drivers/usb/gadget/f_dfu.c +++ b/drivers/usb/gadget/f_dfu.c @@ -589,7 +589,7 @@ static int dfu_prepare_function(struct f_dfu *f_dfu, int n) struct usb_interface_descriptor *d; int i = 0; - f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n); + f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 1); if (!f_dfu->function) goto enomem; |