Line: 310 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	sb->version = cpu_to_le32(DM_CLONE_MAX_METADATA_VERSION);

	/* Save the metadata space_map root */
	memcpy(&sb->metadata_space_map_root, &cmd->metadata_space_map_root,
	       sizeof(cmd->metadata_space_map_root));

	sb->region_size = cpu_to_le64(cmd->region_size);
	sb->target_size = cpu_to_le64(cmd->target_size);
	sb->bitset_root = cpu_to_le64(cmd->bitset_root);

            

Line: 196 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	packet->header.len = 0x80 | (count - 1);
	packet->header.addr = cpu_to_be32(addr);
	memcpy(packet->payload, data, len);

	ret = i2c_transfer(ts->client->adapter, &msg, 1);
	if (ret != 1)
		return ret < 0 ? ret : -EIO;


            

Line: 70 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	init.func = init32.func;
	init.sarea_priv_offset = init32.sarea_priv_offset;
	memcpy(&init.chipset, &init32.chipset,
		offsetof(drm_mga_init_t, fb_offset) -
		offsetof(drm_mga_init_t, chipset));
	init.fb_offset = init32.fb_offset;
	init.mmio_offset = init32.mmio_offset;
	init.status_offset = init32.status_offset;

            

Line: 1195 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	if (*enabled) {
		eld = intel_encoder->audio_connector->eld;
		ret = drm_eld_size(eld);
		memcpy(buf, eld, min(max_bytes, ret));
	}

	mutex_unlock(&dev_priv->av_mutex);
	return ret;
}

            

Line: 930 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		recv_cnt = msg->rx_len;

	if (recv_cnt)
		memcpy(msg->rx_buf, src_addr, recv_cnt);

	DRM_INFO("dsi get %d byte data from the panel address(0x%x)\n",
		 recv_cnt, *((u8 *)(msg->tx_buf)));

	return recv_cnt;

            

Line: 344 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	.start = mtk_ufoe_start,
};

static const char * const mtk_ddp_comp_stem[MTK_DDP_COMP_TYPE_MAX] = {
	[MTK_DISP_OVL] = "ovl",
	[MTK_DISP_OVL_2L] = "ovl-2l",
	[MTK_DISP_RDMA] = "rdma",
	[MTK_DISP_WDMA] = "wdma",
	[MTK_DISP_COLOR] = "color",

            

Line: 117 Column: 17 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
static struct adb_request *current_req; /* first request struct in the queue */
static struct adb_request *last_req;     /* last request struct in the queue */
static unsigned char reply_buf[16];        /* storage for autopolled replies */
static unsigned char *reply_ptr;     /* next byte in reply_buf or req->reply */
static bool reading_reply;       /* store reply in reply_buf else req->reply */
static int data_index;      /* index of the next byte to send from req->data */
static int reply_len; /* number of bytes received in reply_buf or req->reply */
static int status;          /* VIA's ADB status bits captured upon interrupt */

            

Line: 144 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              {
	struct backlight_properties props;
	struct backlight_device *bd;
	char name[10];
	int level, autosave;

	/* Special case for the old PowerBook since I can't test on it */
	autosave =
		of_machine_is_compatible("AAPL,3400/2400") ||

            

Line: 575 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
	*num_output_fmts = dpi->conf->num_output_fmts;

	memcpy(output_fmts, dpi->conf->output_fmts,
	       sizeof(*output_fmts) * dpi->conf->num_output_fmts);

	return output_fmts;
}


            

Line: 19 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	atomic_t guilty;

	/* debug info */
	char pname[TASK_COMM_LEN];
	pid_t pid;
};

struct lima_ctx_mgr {
	struct mutex lock;