The following issues were found
drivers/acpi/acpica/tbprint.c
2 issues
Line: 70
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
struct acpi_table_header *header)
{
memcpy(out_header, header, sizeof(struct acpi_table_header));
acpi_tb_fix_string(out_header->signature, ACPI_NAMESEG_SIZE);
acpi_tb_fix_string(out_header->oem_id, ACPI_OEM_ID_SIZE);
acpi_tb_fix_string(out_header->oem_table_id, ACPI_OEM_TABLE_ID_SIZE);
acpi_tb_fix_string(out_header->asl_compiler_id, ACPI_NAMESEG_SIZE);
Reported by FlawFinder.
Line: 108
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
/* RSDP has no common fields */
memcpy(local_header.oem_id,
ACPI_CAST_PTR(struct acpi_table_rsdp, header)->oem_id,
ACPI_OEM_ID_SIZE);
acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
ACPI_INFO(("RSDP 0x%8.8X%8.8X %06X (v%.2d %-6.6s)",
Reported by FlawFinder.
crypto/nhpoly1305.c
2 issues
Line: 165
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (state->buflen) {
bytes = min(srclen, (int)NH_MESSAGE_UNIT - state->buflen);
memcpy(&state->buffer[state->buflen], src, bytes);
state->buflen += bytes;
if (state->buflen < NH_MESSAGE_UNIT)
return 0;
nhpoly1305_units(state, key, state->buffer, NH_MESSAGE_UNIT,
nh_fn);
Reported by FlawFinder.
Line: 184
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
}
if (srclen) {
memcpy(state->buffer, src, srclen);
state->buflen = srclen;
}
return 0;
}
EXPORT_SYMBOL(crypto_nhpoly1305_update_helper);
Reported by FlawFinder.
drivers/crypto/qcom-rng.c
2 issues
Line: 58
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
break;
if ((max - currsize) >= WORD_SZ) {
memcpy(data, &val, WORD_SZ);
data += WORD_SZ;
currsize += WORD_SZ;
} else {
/* copy only remaining bytes */
memcpy(data, &val, max - currsize);
Reported by FlawFinder.
Line: 63
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
currsize += WORD_SZ;
} else {
/* copy only remaining bytes */
memcpy(data, &val, max - currsize);
break;
}
} while (currsize < max);
return currsize;
Reported by FlawFinder.
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dpp.h
2 issues
Line: 639
struct dcn2_dpp_shift {
TF_REG_FIELD_LIST_DCN2_0(uint8_t);
};
struct dcn2_dpp_mask {
TF_REG_FIELD_LIST_DCN2_0(uint32_t);
};
Reported by Cppcheck.
Line: 639
struct dcn2_dpp_shift {
TF_REG_FIELD_LIST_DCN2_0(uint8_t);
};
struct dcn2_dpp_mask {
TF_REG_FIELD_LIST_DCN2_0(uint32_t);
};
Reported by Cppcheck.
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mmhubbub.c
2 issues
Line: 286
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
REG_UPDATE(MCIF_WB_BUFMGR_SW_CONTROL, MCIF_WB_BUFMGR_SW_LOCK, 0xf);
memcpy(dest_luma_buffer, luma_buffer, mcif_params->luma_pitch * dest_height);
memcpy(dest_chroma_buffer, chroma_buffer, mcif_params->chroma_pitch * dest_height / 2);
REG_UPDATE(MCIF_WB_BUFMGR_SW_CONTROL, MCIF_WB_BUFMGR_SW_LOCK, 0x0);
dump_info->format = out_format;
Reported by FlawFinder.
Line: 287
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
REG_UPDATE(MCIF_WB_BUFMGR_SW_CONTROL, MCIF_WB_BUFMGR_SW_LOCK, 0xf);
memcpy(dest_luma_buffer, luma_buffer, mcif_params->luma_pitch * dest_height);
memcpy(dest_chroma_buffer, chroma_buffer, mcif_params->chroma_pitch * dest_height / 2);
REG_UPDATE(MCIF_WB_BUFMGR_SW_CONTROL, MCIF_WB_BUFMGR_SW_LOCK, 0x0);
dump_info->format = out_format;
dump_info->width = dest_width;
Reported by FlawFinder.
drivers/char/sonypi.c
2 issues
Line: 1121
Column: 2
CWE codes:
120
Suggestion:
Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)
static int sonypi_acpi_add(struct acpi_device *device)
{
sonypi_acpi_device = device;
strcpy(acpi_device_name(device), "Sony laptop hotkeys");
strcpy(acpi_device_class(device), "sony/hotkey");
return 0;
}
static int sonypi_acpi_remove(struct acpi_device *device)
Reported by FlawFinder.
Line: 1122
Column: 2
CWE codes:
120
Suggestion:
Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)
{
sonypi_acpi_device = device;
strcpy(acpi_device_name(device), "Sony laptop hotkeys");
strcpy(acpi_device_class(device), "sony/hotkey");
return 0;
}
static int sonypi_acpi_remove(struct acpi_device *device)
{
Reported by FlawFinder.
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
2 issues
Line: 1002
};
static const struct dccg_shift dccg_shift = {
DCCG_MASK_SH_LIST_DCN2(__SHIFT)
};
static const struct dccg_mask dccg_mask = {
DCCG_MASK_SH_LIST_DCN2(_MASK)
};
Reported by Cppcheck.
Line: 3600
Column: 2
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
bb->num_states = num_calculated_states;
// Duplicate the last state, DML always an extra state identical to max state to work
memcpy(&bb->clock_limits[num_calculated_states], &bb->clock_limits[num_calculated_states - 1], sizeof(struct _vcs_dpi_voltage_scaling_st));
bb->clock_limits[num_calculated_states].state = bb->num_states;
}
void dcn20_patch_bounding_box(struct dc *dc, struct _vcs_dpi_soc_bounding_box_st *bb)
{
Reported by FlawFinder.
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h
2 issues
Line: 769
};
struct dcn30_mpc_shift {
MPC_REG_FIELD_LIST_DCN3_0(uint8_t);
};
struct dcn30_mpc_mask {
MPC_REG_FIELD_LIST_DCN3_0(uint32_t);
};
Reported by Cppcheck.
Line: 769
};
struct dcn30_mpc_shift {
MPC_REG_FIELD_LIST_DCN3_0(uint8_t);
};
struct dcn30_mpc_mask {
MPC_REG_FIELD_LIST_DCN3_0(uint32_t);
};
Reported by Cppcheck.
drivers/acpi/acpica/rsmisc.c
2 issues
Line: 13
#include "acresrc.h"
#define _COMPONENT ACPI_RESOURCES
ACPI_MODULE_NAME("rsmisc")
#define INIT_RESOURCE_TYPE(i) i->resource_offset
#define INIT_RESOURCE_LENGTH(i) i->aml_offset
#define INIT_TABLE_LENGTH(i) i->value
#define COMPARE_OPCODE(i) i->resource_offset
#define COMPARE_TARGET(i) i->aml_offset
Reported by Cppcheck.
Line: 307
Column: 4
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
case ACPI_RSC_DATA8:
target = ACPI_ADD_PTR(char, resource, info->value);
memcpy(destination, source, ACPI_GET16(target));
break;
case ACPI_RSC_ADDRESS:
/*
* Common handler for address descriptor flags
Reported by FlawFinder.
drivers/gpu/drm/bridge/lontium-lt9611uxc.c
2 issues
Line: 811
Column: 3
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
lt9611uxc_firmware_write_page(lt9611uxc, offset, fw->data + offset);
if (remain > 0) {
char buf[LT9611UXC_FW_PAGE_SIZE];
memset(buf, 0xff, LT9611UXC_FW_PAGE_SIZE);
memcpy(buf, fw->data + offset, remain);
lt9611uxc_firmware_write_page(lt9611uxc, offset, buf);
}
Reported by FlawFinder.
Line: 814
Column: 3
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
char buf[LT9611UXC_FW_PAGE_SIZE];
memset(buf, 0xff, LT9611UXC_FW_PAGE_SIZE);
memcpy(buf, fw->data + offset, remain);
lt9611uxc_firmware_write_page(lt9611uxc, offset, buf);
}
msleep(20);
readbuf = lt9611uxc_firmware_read(lt9611uxc, fw->size);
Reported by FlawFinder.