| Message ID | 20170905181658.23893-1-colin.king@canonical.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | e3ae1c7720462136aaa1119c656704bd96952f4d |
| Delegated to: | Kalle Valo |
| Headers | show |
On Tue, 5 Sep 2017 19:16:58 +0100 Colin King <colin.king@canonical.com> wrote: > From: Colin Ian King <colin.king@canonical.com> > > The u8 char array ret is not being initialized and elements outside > the range start to end contain just garbage values from the stack. > This results in a later scan of the array to read potentially > uninitialized values. Fix this by initializing the array to zero. > This seems to have been an issue since the very first commit. > > Detected by CoverityScan CID#139653 ("Uninitialized scalar variable") > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c > index 9501420340a9..eab1c9387846 100644 > --- a/drivers/net/wireless/broadcom/b43legacy/radio.c > +++ b/drivers/net/wireless/broadcom/b43legacy/radio.c > @@ -280,7 +280,7 @@ u8 b43legacy_radio_aci_detect(struct b43legacy_wldev *dev, u8 channel) > u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) > { > struct b43legacy_phy *phy = &dev->phy; > - u8 ret[13]; > + u8 ret[13] = { 0 }; > unsigned int channel = phy->channel; > unsigned int i; > unsigned int j; This fix seems to be correct. Thanks for finding and fixing the issue. Reviewed-by: Michael Buesch <m@bues.ch>
diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c index 9501420340a9..eab1c9387846 100644 --- a/drivers/net/wireless/broadcom/b43legacy/radio.c +++ b/drivers/net/wireless/broadcom/b43legacy/radio.c @@ -280,7 +280,7 @@ u8 b43legacy_radio_aci_detect(struct b43legacy_wldev *dev, u8 channel) u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) { struct b43legacy_phy *phy = &dev->phy; - u8 ret[13]; + u8 ret[13] = { 0 }; unsigned int channel = phy->channel; unsigned int i; unsigned int j;