The following issues were found
include/uapi/sound/emu10k1.h
6 issues
Line: 274
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct snd_emu10k1_fx8010_info {
unsigned int internal_tram_size; /* in samples */
unsigned int external_tram_size; /* in samples */
char fxbus_names[16][32]; /* names of FXBUSes */
char extin_names[16][32]; /* names of external inputs */
char extout_names[32][32]; /* names of external outputs */
unsigned int gpr_controls; /* count of GPR controls */
};
Reported by FlawFinder.
Line: 275
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned int internal_tram_size; /* in samples */
unsigned int external_tram_size; /* in samples */
char fxbus_names[16][32]; /* names of FXBUSes */
char extin_names[16][32]; /* names of external inputs */
char extout_names[32][32]; /* names of external outputs */
unsigned int gpr_controls; /* count of GPR controls */
};
#define EMU10K1_GPR_TRANSLATION_NONE 0
Reported by FlawFinder.
Line: 276
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned int external_tram_size; /* in samples */
char fxbus_names[16][32]; /* names of FXBUSes */
char extin_names[16][32]; /* names of external inputs */
char extout_names[32][32]; /* names of external outputs */
unsigned int gpr_controls; /* count of GPR controls */
};
#define EMU10K1_GPR_TRANSLATION_NONE 0
#define EMU10K1_GPR_TRANSLATION_TABLE100 1
Reported by FlawFinder.
Line: 296
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
int iface; /* interface identifier */
unsigned int device; /* device/client number */
unsigned int subdevice; /* subdevice (substream) number */
unsigned char name[44]; /* ASCII name of item */
unsigned int index; /* index of item */
};
struct snd_emu10k1_fx8010_control_gpr {
struct emu10k1_ctl_elem_id id; /* full control ID definition */
Reported by FlawFinder.
Line: 325
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
};
struct snd_emu10k1_fx8010_code {
char name[128];
__EMU10K1_DECLARE_BITMAP(gpr_valid, 0x200); /* bitmask of valid initializers */
__u32 *gpr_map; /* initializers */
unsigned int gpr_add_control_count; /* count of GPR controls to add/replace */
Reported by FlawFinder.
Line: 368
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned short gpr_trigger; /* GPR containing trigger (activate) information (host) */
unsigned short gpr_running; /* GPR containing info if PCM is running (FX8010) */
unsigned char pad; /* reserved */
unsigned char etram[32]; /* external TRAM address & data (one per channel) */
unsigned int res2; /* reserved */
};
#define SNDRV_EMU10K1_VERSION SNDRV_PROTOCOL_VERSION(1, 0, 1)
Reported by FlawFinder.
include/video/tdfx.h
6 issues
Line: 158
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct banshee_reg {
/* VGA rubbish */
unsigned char att[21];
unsigned char crt[25];
unsigned char gra[9];
unsigned char misc[1];
unsigned char seq[5];
Reported by FlawFinder.
Line: 159
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct banshee_reg {
/* VGA rubbish */
unsigned char att[21];
unsigned char crt[25];
unsigned char gra[9];
unsigned char misc[1];
unsigned char seq[5];
/* Banshee extensions */
Reported by FlawFinder.
Line: 160
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
/* VGA rubbish */
unsigned char att[21];
unsigned char crt[25];
unsigned char gra[9];
unsigned char misc[1];
unsigned char seq[5];
/* Banshee extensions */
unsigned char ext[2];
Reported by FlawFinder.
Line: 161
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned char att[21];
unsigned char crt[25];
unsigned char gra[9];
unsigned char misc[1];
unsigned char seq[5];
/* Banshee extensions */
unsigned char ext[2];
unsigned long vidcfg;
Reported by FlawFinder.
Line: 162
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned char crt[25];
unsigned char gra[9];
unsigned char misc[1];
unsigned char seq[5];
/* Banshee extensions */
unsigned char ext[2];
unsigned long vidcfg;
unsigned long vidpll;
Reported by FlawFinder.
Line: 165
Column: 11
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
unsigned char seq[5];
/* Banshee extensions */
unsigned char ext[2];
unsigned long vidcfg;
unsigned long vidpll;
unsigned long mempll;
unsigned long gfxpll;
unsigned long dacmode;
Reported by FlawFinder.
include/xen/interface/io/ring.h
6 issues
Line: 386
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
{ \
if (*masked_cons < masked_prod || \
size <= ring_size - *masked_cons) { \
memcpy(opaque, buf + *masked_cons, size); \
} else { \
memcpy(opaque, buf + *masked_cons, ring_size - *masked_cons); \
memcpy((unsigned char *)opaque + ring_size - *masked_cons, buf, \
size - (ring_size - *masked_cons)); \
} \
Reported by FlawFinder.
Line: 388
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
size <= ring_size - *masked_cons) { \
memcpy(opaque, buf + *masked_cons, size); \
} else { \
memcpy(opaque, buf + *masked_cons, ring_size - *masked_cons); \
memcpy((unsigned char *)opaque + ring_size - *masked_cons, buf, \
size - (ring_size - *masked_cons)); \
} \
*masked_cons = name##_mask(*masked_cons + size, ring_size); \
} \
Reported by FlawFinder.
Line: 389
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
memcpy(opaque, buf + *masked_cons, size); \
} else { \
memcpy(opaque, buf + *masked_cons, ring_size - *masked_cons); \
memcpy((unsigned char *)opaque + ring_size - *masked_cons, buf, \
size - (ring_size - *masked_cons)); \
} \
*masked_cons = name##_mask(*masked_cons + size, ring_size); \
} \
\
Reported by FlawFinder.
Line: 404
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
{ \
if (*masked_prod < masked_cons || \
size <= ring_size - *masked_prod) { \
memcpy(buf + *masked_prod, opaque, size); \
} else { \
memcpy(buf + *masked_prod, opaque, ring_size - *masked_prod); \
memcpy(buf, (unsigned char *)opaque + (ring_size - *masked_prod), \
size - (ring_size - *masked_prod)); \
} \
Reported by FlawFinder.
Line: 406
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
size <= ring_size - *masked_prod) { \
memcpy(buf + *masked_prod, opaque, size); \
} else { \
memcpy(buf + *masked_prod, opaque, ring_size - *masked_prod); \
memcpy(buf, (unsigned char *)opaque + (ring_size - *masked_prod), \
size - (ring_size - *masked_prod)); \
} \
*masked_prod = name##_mask(*masked_prod + size, ring_size); \
} \
Reported by FlawFinder.
Line: 407
Column: 9
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
memcpy(buf + *masked_prod, opaque, size); \
} else { \
memcpy(buf + *masked_prod, opaque, ring_size - *masked_prod); \
memcpy(buf, (unsigned char *)opaque + (ring_size - *masked_prod), \
size - (ring_size - *masked_prod)); \
} \
*masked_prod = name##_mask(*masked_prod + size, ring_size); \
} \
\
Reported by FlawFinder.
net/ncsi/ncsi-rsp.c
6 issues
Line: 471
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
spin_lock_irqsave(&nc->lock, flags);
if (enabled) {
set_bit(cmd->index - 1, bitmap);
memcpy(&ncf->addrs[index], cmd->mac, ETH_ALEN);
} else {
clear_bit(cmd->index - 1, bitmap);
eth_zero_addr(&ncf->addrs[index]);
}
spin_unlock_irqrestore(&nc->lock, flags);
Reported by FlawFinder.
Line: 629
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
saddr.sa_family = ndev->type;
ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
memcpy(saddr.sa_data, &rsp->data[MLX_MAC_ADDR_OFFSET], ETH_ALEN);
/* Set the flag for GMA command which should only be called once */
ndp->gma_flag = 1;
ret = ops->ndo_set_mac_address(ndev, &saddr);
if (ret < 0)
Reported by FlawFinder.
Line: 671
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
saddr.sa_family = ndev->type;
ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
memcpy(saddr.sa_data, &rsp->data[BCM_MAC_ADDR_OFFSET], ETH_ALEN);
/* Increase mac address by 1 for BMC's address */
eth_addr_inc((u8 *)saddr.sa_data);
if (!is_valid_ether_addr((const u8 *)saddr.sa_data))
return -ENXIO;
Reported by FlawFinder.
Line: 769
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
ncv = &nc->version;
ncv->version = ntohl(rsp->ncsi_version);
ncv->alpha2 = rsp->alpha2;
memcpy(ncv->fw_name, rsp->fw_name, 12);
ncv->fw_version = ntohl(rsp->fw_version);
for (i = 0; i < ARRAY_SIZE(ncv->pci_ids); i++)
ncv->pci_ids[i] = ntohs(rsp->pci_ids[i]);
ncv->mf_id = ntohl(rsp->mf_id);
Reported by FlawFinder.
Line: 881
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
else
set_bit(i, bitmap);
memcpy(&ncmf->addrs[i * ETH_ALEN], pdata, ETH_ALEN);
}
spin_unlock_irqrestore(&nc->lock, flags);
/* VLAN filter table */
enable = ntohs(rsp->vlan_enable);
Reported by FlawFinder.
Line: 1049
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (!np)
return -ENODEV;
memcpy(np->uuid, rsp->uuid, sizeof(rsp->uuid));
return 0;
}
static int ncsi_rsp_handler_pldm(struct ncsi_request *nr)
Reported by FlawFinder.
init/initramfs.c
6 issues
Line: 100
Column: 2
CWE codes:
120
Suggestion:
Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)
q->minor = minor;
q->ino = ino;
q->mode = mode;
strcpy(q->name, name);
q->next = NULL;
*p = q;
return NULL;
}
Reported by FlawFinder.
Line: 68
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
int ino, minor, major;
umode_t mode;
struct hash *next;
char name[N_ALIGN(PATH_MAX)];
} *head[32];
static inline int hash(int major, int minor, int ino)
{
unsigned long tmp = ino + minor + (major << 3);
Reported by FlawFinder.
Line: 172
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static void __init parse_header(char *s)
{
unsigned long parsed[12];
char buf[9];
int i;
buf[8] = '\0';
for (i = 0, s += 6; i < 12; i++, s += 8) {
memcpy(buf, s, 8);
Reported by FlawFinder.
Line: 177
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
buf[8] = '\0';
for (i = 0, s += 6; i < 12; i++, s += 8) {
memcpy(buf, s, 8);
parsed[i] = simple_strtoul(buf, NULL, 16);
}
ino = parsed[0];
mode = parsed[1];
uid = parsed[2];
Reported by FlawFinder.
Line: 248
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
unsigned long n = remains;
if (byte_count < n)
n = byte_count;
memcpy(collect, victim, n);
eat(n);
collect += n;
if ((remains -= n) != 0)
return 1;
state = next_state;
Reported by FlawFinder.
Line: 468
Column: 20
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
long written;
decompress_fn decompress;
const char *compress_name;
static __initdata char msg_buf[64];
header_buf = kmalloc(110, GFP_KERNEL);
symlink_buf = kmalloc(PATH_MAX + N_ALIGN(PATH_MAX) + 1, GFP_KERNEL);
name_buf = kmalloc(N_ALIGN(PATH_MAX), GFP_KERNEL);
Reported by FlawFinder.
kernel/bpf/cgroup.c
6 issues
Line: 1130
Column: 17
CWE codes:
362/367!
Suggestion:
Set up the correct permissions (e.g., using setuid()) and try to open the file directly
EXPORT_SYMBOL(__cgroup_bpf_run_filter_sock_ops);
int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor,
short access, enum bpf_attach_type type)
{
struct cgroup *cgrp;
struct bpf_cgroup_dev_ctx ctx = {
.access_type = (access << 16) | dev_type,
.major = major,
Reported by FlawFinder.
Line: 1134
Column: 19
CWE codes:
362/367!
Suggestion:
Set up the correct permissions (e.g., using setuid()) and try to open the file directly
{
struct cgroup *cgrp;
struct bpf_cgroup_dev_ctx ctx = {
.access_type = (access << 16) | dev_type,
.major = major,
.minor = minor,
};
int allow = 1;
Reported by FlawFinder.
Line: 1265
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
ctx.new_val = kmalloc_track_caller(PAGE_SIZE, GFP_KERNEL);
ctx.new_len = min_t(size_t, PAGE_SIZE, *pcount);
if (ctx.new_val) {
memcpy(ctx.new_val, *buf, ctx.new_len);
} else {
/* Let BPF program decide how to proceed. */
ctx.new_len = 0;
}
}
Reported by FlawFinder.
Line: 1429
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
ret = -ENOMEM;
goto out;
}
memcpy(p, ctx.optval, ctx.optlen);
*kernel_optval = p;
} else {
*kernel_optval = ctx.optval;
}
/* export and don't free sockopt buf */
Reported by FlawFinder.
Line: 1658
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
return -EINVAL;
}
memcpy(dst, src, min(dst_len, src_len));
if (dst_len > src_len) {
memset(dst + src_len, '\0', dst_len - src_len);
return src_len;
}
Reported by FlawFinder.
Line: 1714
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (buf_len > PAGE_SIZE - 1)
return -E2BIG;
memcpy(ctx->new_val, buf, buf_len);
ctx->new_len = buf_len;
ctx->new_updated = 1;
return 0;
}
Reported by FlawFinder.
kernel/auditfilter.c
6 issues
Line: 142
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (unlikely(!str))
return ERR_PTR(-ENOMEM);
memcpy(str, *bufp, len);
str[len] = 0;
*bufp += len;
*remain -= len;
return str;
Reported by FlawFinder.
Line: 619
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
{
size_t len = strlen(str);
memcpy(*bufp, str, len);
*bufp += len;
return len;
}
Reported by FlawFinder.
Line: 843
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
* the beginning of list scan.
*/
new->tree = old->tree;
memcpy(new->fields, old->fields, sizeof(struct audit_field) * fcount);
/* deep copy this information, updating the lsm_rule fields, because
* the originals will all be freed when the old rule is freed. */
for (i = 0; i < fcount; i++) {
switch (new->fields[i].type) {
Reported by FlawFinder.
Line: 617
Column: 15
CWE codes:
126
/* Pack a filter field's string representation into data block. */
static inline size_t audit_pack_string(void **bufp, const char *str)
{
size_t len = strlen(str);
memcpy(*bufp, str, len);
*bufp += len;
return len;
Reported by FlawFinder.
Line: 1272
Column: 9
CWE codes:
126
int plen;
const char *p;
plen = strlen(path);
if (plen == 0)
return plen;
/* disregard trailing slashes */
Reported by FlawFinder.
Line: 1307
Column: 12
CWE codes:
126
const char *p;
dlen = dname->len;
pathlen = strlen(path);
if (pathlen < dlen)
return 1;
parentlen = parentlen == AUDIT_NAME_FULL ? parent_len(path) : parentlen;
if (pathlen - parentlen != dlen)
Reported by FlawFinder.
net/l2tp/trace.h
6 issues
Line: 34
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
__array(char, name, L2TP_TUNNEL_NAME_MAX)
),
TP_fast_assign(
memcpy(__entry->name, tunnel->name, L2TP_TUNNEL_NAME_MAX);
),
TP_printk("%s", __entry->name)
);
DECLARE_EVENT_CLASS(session_only_evt,
Reported by FlawFinder.
Line: 46
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
__array(char, name, L2TP_SESSION_NAME_MAX)
),
TP_fast_assign(
memcpy(__entry->name, session->name, L2TP_SESSION_NAME_MAX);
),
TP_printk("%s", __entry->name)
);
TRACE_EVENT(register_tunnel,
Reported by FlawFinder.
Line: 63
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
__field(enum l2tp_encap_type, encap)
),
TP_fast_assign(
memcpy(__entry->name, tunnel->name, L2TP_TUNNEL_NAME_MAX);
__entry->fd = tunnel->fd;
__entry->tid = tunnel->tunnel_id;
__entry->ptid = tunnel->peer_tunnel_id;
__entry->version = tunnel->version;
__entry->encap = tunnel->encap;
Reported by FlawFinder.
Line: 102
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
__field(enum l2tp_pwtype, pwtype)
),
TP_fast_assign(
memcpy(__entry->name, session->name, L2TP_SESSION_NAME_MAX);
__entry->tid = session->tunnel ? session->tunnel->tunnel_id : 0;
__entry->ptid = session->tunnel ? session->tunnel->peer_tunnel_id : 0;
__entry->sid = session->session_id;
__entry->psid = session->peer_session_id;
__entry->pwtype = session->pwtype;
Reported by FlawFinder.
Line: 147
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
__field(u32, nr)
),
TP_fast_assign(
memcpy(__entry->name, session->name, L2TP_SESSION_NAME_MAX);
__entry->ns = session->ns;
__entry->nr = session->nr;
),
TP_printk("%s: ns=%u nr=%u",
__entry->name,
Reported by FlawFinder.
Line: 177
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
__field(u32, reorder_q_len)
),
TP_fast_assign(
memcpy(__entry->name, session->name, L2TP_SESSION_NAME_MAX);
__entry->pkt_ns = pkt_ns,
__entry->my_nr = session->nr;
__entry->reorder_q_len = skb_queue_len(&session->reorder_q);
),
TP_printk("%s: pkt_ns=%u my_nr=%u reorder_q_len=%u",
Reported by FlawFinder.
net/l2tp/l2tp_ppp.c
6 issues
Line: 936
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
sp.pppol2tp.addr.sin_family = AF_INET;
sp.pppol2tp.addr.sin_port = inet->inet_dport;
sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
memcpy(uaddr, &sp, len);
#if IS_ENABLED(CONFIG_IPV6)
} else if (tunnel->version == 2 && tunnel->sock->sk_family == AF_INET6) {
struct sockaddr_pppol2tpin6 sp;
len = sizeof(sp);
Reported by FlawFinder.
Line: 953
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
sp.pppol2tp.d_session = session->peer_session_id;
sp.pppol2tp.addr.sin6_family = AF_INET6;
sp.pppol2tp.addr.sin6_port = inet->inet_dport;
memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
sizeof(tunnel->sock->sk_v6_daddr));
memcpy(uaddr, &sp, len);
} else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
struct sockaddr_pppol2tpv3in6 sp;
Reported by FlawFinder.
Line: 955
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
sp.pppol2tp.addr.sin6_port = inet->inet_dport;
memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
sizeof(tunnel->sock->sk_v6_daddr));
memcpy(uaddr, &sp, len);
} else if (tunnel->version == 3 && tunnel->sock->sk_family == AF_INET6) {
struct sockaddr_pppol2tpv3in6 sp;
len = sizeof(sp);
memset(&sp, 0, len);
Reported by FlawFinder.
Line: 971
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
sp.pppol2tp.d_session = session->peer_session_id;
sp.pppol2tp.addr.sin6_family = AF_INET6;
sp.pppol2tp.addr.sin6_port = inet->inet_dport;
memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
sizeof(tunnel->sock->sk_v6_daddr));
memcpy(uaddr, &sp, len);
#endif
} else if (tunnel->version == 3) {
struct sockaddr_pppol2tpv3 sp;
Reported by FlawFinder.
Line: 973
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
sp.pppol2tp.addr.sin6_port = inet->inet_dport;
memcpy(&sp.pppol2tp.addr.sin6_addr, &tunnel->sock->sk_v6_daddr,
sizeof(tunnel->sock->sk_v6_daddr));
memcpy(uaddr, &sp, len);
#endif
} else if (tunnel->version == 3) {
struct sockaddr_pppol2tpv3 sp;
len = sizeof(sp);
Reported by FlawFinder.
Line: 991
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
sp.pppol2tp.addr.sin_family = AF_INET;
sp.pppol2tp.addr.sin_port = inet->inet_dport;
sp.pppol2tp.addr.sin_addr.s_addr = inet->inet_daddr;
memcpy(uaddr, &sp, len);
}
error = len;
sock_put(sk);
Reported by FlawFinder.
include/linux/tc.h
6 issues
Line: 69
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct resource resource[2]; /* Address space routed to this bus. */
struct device dev;
char name[13];
resource_size_t slot_base;
resource_size_t ext_slot_base;
resource_size_t ext_slot_size;
int num_tcslots;
struct tcinfo info;
Reported by FlawFinder.
Line: 88
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct device dev; /* Generic device interface. */
struct resource resource; /* Address space of this device. */
u64 dma_mask; /* DMA addressable range. */
char vendor[9];
char name[9];
char firmware[9];
int interrupt;
int slot;
};
Reported by FlawFinder.
Line: 89
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct resource resource; /* Address space of this device. */
u64 dma_mask; /* DMA addressable range. */
char vendor[9];
char name[9];
char firmware[9];
int interrupt;
int slot;
};
Reported by FlawFinder.
Line: 90
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
u64 dma_mask; /* DMA addressable range. */
char vendor[9];
char name[9];
char firmware[9];
int interrupt;
int slot;
};
#define to_tc_dev(n) container_of(n, struct tc_dev, dev)
Reported by FlawFinder.
Line: 98
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
#define to_tc_dev(n) container_of(n, struct tc_dev, dev)
struct tc_device_id {
char vendor[9];
char name[9];
};
/*
* TURBOchannel driver.
Reported by FlawFinder.
Line: 99
Column: 2
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
struct tc_device_id {
char vendor[9];
char name[9];
};
/*
* TURBOchannel driver.
*/
Reported by FlawFinder.