Line: 84 Column: 2 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	int qabort;		/* Flag to cause an abort */
	int qlirq;		/* IRQ being used */
	int int_type;		/* type of irq, 2 for ISA board, 0 for PCMCIA */
	char qinfo[80];		/* description */
	struct scsi_cmnd *qlcmd;	/* current command being processed */
	struct Scsi_Host *shost;	/* pointer back to host */
	struct qlogicfas408_priv *next; /* next private struct */
};


            

Line: 219 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	if (!urb)
		goto error_no_urb;

	memcpy(buffer, buf, count);

	usb_serial_debug_data(&port->dev, __func__, count, buffer);

	/* The connected devices do not have a bulk write endpoint,
	 * to transmit data to de barcode device the control endpoint is used */

            

Line: 109 Column: 2 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              	priv->shost = hreg;
	priv->int_type = INT_TYPE;

	sprintf(priv->qinfo,
		"Qlogicfas Driver version 0.46, chip %02X at %03X, IRQ %d, TPdma:%d",
		qltyp, qbase, qlirq, QL_TURBO_PDMA);
	host->name = qlogicfas_name;

	if (request_irq(qlirq, qlogicfas408_ihandl, 0, qlogicfas_name, hreg))

            

Line: 927 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	*data++ = port_priv->device_port;
	put_unaligned_le16(count, data);
	data += 2;
	memcpy(data, buf, count);

	write_urb->transfer_buffer_length = count + QT2_WRITE_CONTROL_SIZE;

	status = usb_submit_urb(write_urb, GFP_ATOMIC);
	if (status == 0) {

            

Line: 468 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		goto error_no_urb;
	}

	memcpy(buffer, buf, writesize);

	usb_serial_debug_data(&port->dev, __func__, writesize, buffer);

	usb_fill_bulk_urb(urb, serial->dev,
			  usb_sndbulkpipe(serial->dev,

            

Line: 293 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	unsigned long flags;
	unsigned int cflag = tty->termios.c_cflag;
	unsigned short uartdata;
	unsigned char buf[2] = {0, 0};
	int baud;
	int i;
	u8 control;

	/* check that they really want us to change something */

            

Line: 17 Column: 14 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
#define USB_DEBUG_MAX_PACKET_SIZE	8
#define USB_DEBUG_BRK_SIZE		8
static const char USB_DEBUG_BRK[USB_DEBUG_BRK_SIZE] = {
	0x00,
	0xff,
	0x01,
	0xfe,
	0x00,

            

Line: 176 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              		}

		/* send the data */
		memcpy(this_urb->transfer_buffer, buf, todo);
		this_urb->transfer_buffer_length = todo;

		spin_lock_irqsave(&intfdata->susp_lock, flags);
		if (intfdata->suspended) {
			usb_anchor_urb(this_urb, &portdata->delayed);

            

Line: 981 Column: 11 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              	uint8_t mac_addr[6];	/* 16-1b MAC address for this PCI function */
	uint32_t iscsi_pci_func_cnt;  /* 1c-1f number of iSCSI PCI functions */
	uint32_t pci_func;	      /* 20-23 this PCI function */
	unsigned char serial_number[16];  /* 24-33 serial number string */
	uint8_t reserved[12];		  /* 34-3f */
};

struct about_fw_info {
	uint16_t fw_major;		/* 00 - 01 */

            

Line: 67 Column: 2 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              	bcb->Flags = bcb->Lun = 0;
	bcb->Length = sizeof(init_string) - 1;
	memset(bcb->CDB, 0, sizeof(bcb->CDB));
	memcpy(bcb->CDB, init_string, sizeof(init_string) - 1);

	res = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcb,
			US_BULK_CB_WRAP_LEN, &partial);
	if (res)
		return -EIO;